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providing  fire  and  overheat  detection  capability  with  a high  degree  of 
reliability. 

The  IFOS  consists  of  six  ultraviolet  flame  detector  heads,  two  overheat- 
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indicate  fire  and  overheat  conditions,  a maintenance  warning  unit  to  Indicate 
component  failure.  The  system  is  self-testing  to  an  important  degree  and 
completely  automatic  in  operation. 

Three  such  systems  were  constructed  and  extensively  tested.  Tests  included 
operation  under  various  conditions  of  input  voltage,  temperature  and  altitude. 
Response  times  to  fire  and  overheat  conditions  were  measured,  and  one  system 
was  subjected  to  vibration,  shock,  humidity,  salt  spray  and  electromagnetic 
interference  tests.  In  addition,  a theoretical  study  of  reliability  was  made. 

While  the  above  tests  uncovered  a number  of  design  weaknesses,  all  of  these 
defects  could  be  overcome  in  designing  an  improved  model  of  the  IFOS.  It  is 
concluded  that  a high  reliability,  automatic  fire  and  overheat  detection 
system  is  definitely  feasible. 
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manufacturers  in  this  report  is  not  to  be 
construed  as  official  government  endorse- 
ment or  approval  of  commercial  products 
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I 

INTRODUCTION 


1 .  BACKGROUND 

Most  operational  Air  Force  aircraft  are  equipped  with  overheat  sen- 
sors for  fire  and  overheat  detection.  These  systems  do  not  offer  adequate 
fire  detection  capability,  as  evidenced  by  their  inability  to  detect  a 
large  percentage  of  the  engine  nacelle  fires  in  Air  Force  aircraft.  In 
addition,  these  systems  are  highly  susceptible  to  false  alarms  which  result 
in  aborted  missions,  high  operational  and  maintenance  costs  and  in  a few 
instances,  loss  of  aircraft  and  lives. 

In  the  1960's,  the  AFAPL  originated  the  concept  of  the  Integrated 
Fire  and  Overheat  Detection  System  which,  because  of  the  system's  elec- 
tronics and  the  redundant  and  overlapping  coverage  provided  by  the  radiation 
sensors  and  overheat  cables,  significantly  increased  the  hazard  detection 
capability  and  reduced  or  eliminated  the  false  alarm  problem  associated 
with  present  day  detection  systems.  This  system  concept  consists  of 
radiation  sensors  for  fire  and  overheat  cables  for  overheat  detection,  to- 
gether with  a microcircuit  for  signal  processing,  thus  providing  complete 
hazard  detection  capability  for  the  engine  nacelle  of  an  aircraft. 

The  objective  of  this  program  was  to  develop  a flight  qualifiable 
Integrated  Fire  and  Overheat  Detection  System  with  potential  application 
for  the  engine  compartments  of  an  advanced  multi-engine  bomber/ transport 
aircraft.  This  system  is  to  distinguish  between  a fire  and  an  overheat 
condition  and  provide  highly  reliable  hazard  detection  capability. 

Three  complete  systems,  with  spares,  were  delivered  to  the  Air  Force 
in  1976  for  evaluation. 


2.  GENERAL  DESCRIPTION  OF  SYSTEM 

The  system  developed  under  this  program  consists  of  six  ultraviolet 
radiation  detector  heads  for  detecting  engine  compartment  fires,  a dual 
loop  overheat  cable  for  detecting  overheat  conditions  in  the  engine  com- 
partment, a computer  control  unit,  a crew  readout  unit  and  a maintenance 
warning  unit.  See  Figure  1.  Each  radiation  detector  head  contains  two 
ultraviolet  radiation  sensors  and  the  dual  loop  overheat  cable  were 
developed  for  mounting  in  the  engine  compartment  of  an  aircraft.  The 
computer  control  unit  and  the  maintenance  warning  unit  were  developed  for 
installation  into  an  aircraft  electronic  bay.  The  readout  unit  was 
developed  for  installation  into  the  aircraft  crew  compartment. 


3.  SYSTEM  SPECIFICATIONS 

The  exact,  detailed  specifications  for  this  system  are  found  in  Air 
Force  Contract  F33615-72-C-1053,  and  in  the  Military  Specifications  to 
which  this  contract  refers.  For  the  convenience  of  the  reader,  these 
specifications  are  summarized  below. 
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3.1  Response  to  Flame 


Each  engine  nacelle  is  monitored  by  all  six  flame  detector  heads  of 
the  IFOS.  If  one  or  more  of  these  heads  detects  a flame,  the  FIRE  indica- 
tor on  the  Crew  Readout  Unit  (CRU)  is  turned  on.  The  sensitivity  of  each 
head  is  such  that  a burning  5-inch  diameter  pan  of  gasoline  or  JP4  fuel 
is  readily  detected  at  a distance  of  4 feet.  The  FIRE  indicator  comes  on 
within  .5  second  of  exposure  to  flame,  and  goes  out  within  1.5  seconds  of 
removal  of  the  flame. 

3.2  Flame  Detector  Self-Checking  Features 

Each  detector  head  is  furnished  with  a small  UV  source  lamp.  This 
lamp  is  automatically  energized  for  .1  second  every  14.4  seconds.  If  a 
sensor  tube  does  not  respond  normally,  an  indicator,  numbered  to  corres- 
pond to  the  sensor  tube,  is  energized  on  the  Maintenance  Warning  Unit 
fMWU)  . 

Normally,  both  sensor  tubes  in  any  one  detector  head  respond  to  the 
same  flame.  If  only  one  tube  of  the  pair  generates  an  output,  this  is 
disregarded  as  being  false  if  the  other  tube  had  a normal  response  to  the 
most  recent  test.  If,  on  the  other  hand,  the  second  tube  had  not  responded 
normally  to  the  most  recent  test,  then  the  output  from  the  first  tube  is 
taken  as  indicating  a fire,  and  the  FIRE  indicator  is  energized. 

It  is  planned  that  the  six  flame  detector  heads  will  be  deployed  in 
such  a manner  that  any  fire  will  cause  an  output  from  at  least  two 
ad j acent ly-numbered  heads.  (Numbers  considered  to  be  adjacent  are  1 and  2, 

2 and  3,  3 and  4,  4 and  5,  5 and  6,  and  6 and  1.)  The  system  is  designed 
so  that  if  all  four  sensor  tubes  in  any  two  adjacent  heads  fail,  the  FIRE 
FAIL  indicator  of  the  Crew  Readout  Unit  will  be  activated  by  means  of  a 
latching  relay.  This  relay  can  be  reset  only  by  pressing  the  RESET  button 
on  the  MWU . Also,  the  relay  prevents  the  FIRE  indicator  from  being  activated 
by  any  head  until  the  relay  is  reset. 

3.3  Response  to  Overheat 

In  addition  to  the  six  flame  detector  heads,  each  engine  nacelle  is 
monitored  by  a dual-loop  overheat  cable.  This  consists  of  two  fifty-foot 
Edison  thermistor  cables,  installed  side-by-side. 

If  any  portion  of  both  cables  is  heated  to  a temperature  of  398. 8°C 
(750°F  ±37.5°F),  then  the  OHEAT  (overheat)  indicator  of  the  CRl'  is  energized. 
The  alarm  is  given  within  5 seconds  of  the  application  of  an  815. 5°C 
(1500°F)  overheat  condition,  and  is  extinguished  within  30  seconds  of  the 
removal  of  the  overheat  condition. 

3.4  Overheat  Detection  Testing 

The  electrical  continuity  of  each  cable  is  tested  once  every  14.4 
seconds.  If  a cable  is  "open,"  that  is,  does  not  exhibit  electrical  con- 
tinuity, the  appropriate  CABLE  indicator  is  energized  on  the  MWU.  Also,  a 
very  sudden  decrease  in  cable  resistance  at  any  time  is  taken  to  indicate 
a defect  in  the  cable  of  the  "short  circuit"  tvpe , and  again  the  appropriate 
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CABLE  Indicator  Is  energized.  (An  overheat  condition  Is  distinguished 
from  a cable  short  by  the  fact  that  the  former  causes  a more  gradual  de- 
crease in  cable  resistance.) 

Normally,  both  cables  respond  in  the  same  way  to  a given  overheat 
condition  by  virtue  of  their  side-by-side  physical  configuration.  If 
only  one  cable  of  the  pair  generates  an  output,  this  is  disregarded  as 
being  false  _lf_  no  defect  has  been  detected  in  the  other  cable.  If,  on 
the  other  hand,  an  open  circuit  or  a short  circuit  has  been  detected  in 
the  second  cable,  then  the  output  of  the  first  cable  is  taken  as  indicat- 
ing an  overheat  condition  and  the  OKEAT  indicator  is  energized. 

If  both  cables  are  found  to  be  defective,  the  OHEAT  FAIL  indicator 
of  the  CRU  is  energized  by  means  of  latching  relays.  These  relays  can  be 
reset  only  by  pressing  the  "RESET"  button  on  the  MWU.  Also,  these  relays 
prevent  the  OHEAT  indicator  from  being  activated  until  the  relays  are 
reset . 

3.5  Other  Self-Checking  Features 

Part  of  the  electronic  circuitry  between  the  sensors  and  the  indica- 
tor lamps  is  automatically  tested  every  14.4  seconds.  If  signal  contin- 
uity is  not  verified,  the  CCU  (central  computer  unit)  indicator  on  the  MWU 
is  energized. 

The  output  voltages  of  the  various  power  supplies  of  the  Central 
Computer  Unit  are  continuously  mcnitored.  If  the  supply  voltage  for  the 
UV  sensor  tubes  rises  above  850V  or  falls  below  750V,  then  the  FIRE  FAIL 
AND  OHEAT  FAIL  indicators  of  the  CRU  are  energized,  as  is  the  CCU  indicator 
of  the  MWU.  A similar  response  is  obtained  if  a failure  occurs  in  the 
300V  supply,  the  +5V  supply,  or  the  -5V  supply. 

Since  the  IFOS  logic  circuits  are  of  the  synchronous  type,  an  elec- 
tronic timing  clock  is  employed.  The  clock  oscillator  is  continuously 
monitored,  and  its  failure  will  result  in  the  energization  of  the  FIRE  FAIL, 
OHEAT  FAIL  and  CCU  indicators. 

If  the  primary  power  supply  to  the  entire  Central  Computer  Unit  is 
interrupted,  the  FIRE  FAIL  and  OHEAT  FAIL  indicators  are  activated. 

Although  the  IFOS  has  a high  level  of  reliability  achieved  by  redun- 
dancy and  self-checking  circuitry,  it  is  not  completely  protected  against 
all  types  of  failures  such  us  an  indicator  lamp  failure  or  a relay  contact 
failure . 

3.6  The  Maintenance  Warning  Unit 

The  MWU  is  designed  to  indicate  to  service  personnel  when  maintenance 
work  on  the  IFOS  is  needed,  and  to  provide  some  diagnosis  of  the  trouble. 

There  are  twelve  UV  indicators,  one  for  each  of  the  twelve  sensor 
tubes.  Each  indicator  is  activated  it  its  sensor  tube  does  not  respond  to 
the  test  signal  described  under  3.2,  above. 
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indicators,  labeled  CABLE  A and  CABLE  B.  If  a 
shorted  cable  is  inferred  (see  3.4),  then  the 
is  activated. 


The  remaining  indicator  on  the  MWU  is  labeled  CCU  for  Central  Com- 
puter Unit.  This  indicator  is  activated  when  the  800V  power  supply  voltage 
rises  too  high  or  falls  too  low,  when  the  -5V  or  the  +300V  power  supply 
fails,  when  the  clock  oscillator  stops,  or  when  various  automatic  electrical 
tests  of  the  signal  circuitry  indicate  a fault. 

All  of  the  Indicators  on  the  MWU  are  activated  by  latching  relays. 

Once  closed,  these  relays  remain  closed  until  intentionally  opened  by 
pressing  the  RESET  button  on  the  MWU  front  panel.  Thus,  fault  indication 
is  retained  even  when  the  electrical  power  is  turned  off,  and  even  if  the 
fault  is  intermitent  in  appearance. 

3.7  Power  Requirements 

The  IFOS  is  designed  to  operate  from  a direct  current  power  source 
with  a potential  difference  of  from  18  volts  to  30  volts.  Approximate 
standby  current  requirements  for  a 28  volt  source  are: 


CCU:  1.2  ampere 

MWU:  .120  ampere 

CRL':  .035  ampere 

3.8  Temperature  Range 


Operating  and  storage 
of  the  IFOS  are: 


temperature  ranges 
Operating 


for  the  various  components 
Storage 


CCU 


MWU 


CRU 

UV  Heads 
OH  Cables 
Connection  Cables 


-40°C  to  85°C 
-4C°C  to  71°C 
-40°C  to  71°C 
-54°C  to  260°C 
-54°C  to  815. 5°C 
-54°C  to  110°C 


-65°C  to  150°C 
-65°C  to  150°C 
-65°C  to  150°C 
-65°C  to  260°C 
-65°C  to  815. 5°C 
-65°C  to  110°C 


Additionally,  the  UV  heads  are  designed  to  withstand  1093°C  for  one 
minute . 


3.9  Other  Environmental  Specifications 

The  CCU,  the  UV  heads,  and  the  connecting  cables  are  designed  to 
operate  at  all  altitudes  from  sea  level  to  70,000  feet.  These  units  are 
also  designed  to  withstand  salt  water  spray,  20g  of  shock,  and  high 
humidity,  as  specified  in  MIL-STD-810A . All  sections  of  the  IFOS  are 
designed  to  perform  satisfactorily  under  15g  of  vibration. 

Compliance  with  MIL-STD-461A*  insures  freedom  from  electromagnetic 
interference . 


♦Certain  sections  of  this  Standard  were  waived  by  the  Air  Force  for  the 
delivered  equipment. 
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3.10  Size  and  Weight 


Approximate  dimensions  and  weight  of  each  IFOS  component  is  shown  in 
Table  1.  These  dimensions  neglect  the  protruding  cable  connectors  and 
mounting  brackets. 

3.11  Maintenance  Aids 

The  MWU,  discussed  in  3.6  above,  is  the  primary  diagnostic  aid.  A 
test  jack  is  provided  on  the  CCU  to  enable  service  personnel  to  quickly 
measure  twenty-one  critical  voltages  without  opening  the  case. 


Table  I 

Dimensions  and  Weights  of  IFOS  Components 


Component 

Dimensions 

Weight 

CCU 

7-1/2"  x 12"  x 19" 

30 

lbs . , 

13 

OZ  . 

MWU* 

6"  x 6-1/4"  x 9-1/2" 

6 

lbs . , 

11 

oz . 

CRU* 

5-1/2"  x 5-1/2"  x 8" 

4 

lbs . , 

4 

oz. 

Flame  Detector  Head 

4-1/4"  x 3"  x 3" 

2 

lbs . , 

2 

oz. 

Overheat  Cables** 

— 

1 

lb.  , 

7 

oz . 

Detector  Cable 



3/4 

oz 

/ft 

*Not  including  shock  mounts,  mounting  plates  and  straps 

**Two  cables,  each  composed  of  three  16-foot  cables  in  series. 
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FLAME  DETECTOR  HEAD 


1.  THE  EDISON  U/V  SENSOR  TUBE 

1.1  The  heart  of  the  IFOS  flame  detector  head  is  the  patented  Edison 
ultraviolet  radiation  detector,  shown  in  Figure  2.  This  device  is 
essentially  an  ultraviolet-sensitive  Geiger-Mueller  counter  tube,  respond- 
ing to  radiation  from  1900  h.  to  2900  A.  While  such  radiation  is  emitted 
by  flames  and  arcs,  it  is  seldom  found  within  the  Earth's  atmosphere  from 
other  sources,  including  the  Sun,  fluorescent  lamps  and  incandescent 
lamps.  Thus  the  Edison  tube  is  unlikely  to  generate  a false  alarm. 

Advantages  of  the  Edison  sensor  tube  over  other  flame  detector 
devices  are  many.  They  include: 

a)  Freedom  from  false  alarms,  as  discussed  above 

b)  High  sensitivity,  due  to  gas  amplification  within  the  tube 

c)  Proven  reliability 

d)  Low  cost 

e)  Ability  to  operate  over  an  extreme  temperature  range 

f)  Rapid  response 

g)  Repeat  capability,  which  is  ability  to  operate  during  successive 
fires 

h)  Mechanical  ruggedness  (with  regard  to  shock  and  vibration) 

i)  No  sensitivity  to  humidity,  wind,  or  changes  in  atmospheric 
pressure 

j)  A large  output  signal 

Disadvantages  of  these  sensors  are: 

a)  High-voltage  power  supplies  are  necessary  for  tube  biasing 

b)  The  sensitivity  of  the  sensor  decreases  with  increasing 
temperature 

c)  The  tube  characteristics  change  somewhat  with  aging  and  storage 

d)  A thin  film  of  oil  or  gasoline  between  the  tube  and  a flame 
absorbs  much  ultraviolet  light  and  thus  greatly  reduces  sensitiv- 
ity. (Such  a film  might  occur,  for  example,  when  engine  oil  or 
fuel  is  sprayed  onto  a tube  envelope.) 

Edison  Electronics,  at  present,  manufactures  two  different  types  of 
sensor  tubes,  the  Mark  I and  the  Mark  II.  A specially-screened  Mark  II 
tube  is  used  for  the  IFOS.  The  following  are  some  of  the  details  of  the 
sensor  tube's  construction: 

Outside  Diameter: 

Overall  Length: 

Glass  Envelope: 

Glass  Stem: 

Stem  Leads: 

Electrodes : 
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1.125  inches 
1.625  inches 

Ultraviolet  transmitting  glass 

7720  Nonex 

Nickel-tungsten 

Tungsten 


w 


Further  details  of  tube  construction  and  theory  of  operation  can  be  found 
in  references  (1)  - (3). 

1.2  Circuit  Properties 

Figure  3a  shows  a basic  circuit  for  Geiger-Mueller  tubes.  The  signal 
output  consists  of  random  electrical  pulses  when  the  tube  is  struck  by 
weak  radiation.  Intense  radiation  may  cause  the  tube  to  conduct  continu- 
ously. The  series  resistor  is  always  necessary  to  permit  "quenching"  of 
the  tube — that  is,  restoring  the  tube  to  its  original  condition  after  each 
discharge . 

Three  simple  variations  of  this  circuit  are  shown  in  Figures  3b,  3c 
and  3d.  Also,  small  capacitors  can  be  added  in  various  places  to  modify 
such  characteristics  as  pulse  width.  The  circuit  of  Figure  3d  is  used 
for  the  IFOS. 

Important  dynamic  properties  for  this  sensor  circuitry  include: 

a)  Sensitivity  to  ultraviolet  radiation  from  a flame. 

b)  Response  to  sunlight,  hereafter  referred  to  as  "long-wave 
response . " 

c)  Output  resulting  from  cosmic  rays  and  environmental  radioactivity, 
referred  to  as  the  "background  count." 

d)  Output  resulting  from  no  discernible  cause,  referred  to  as  "self- 
excitation." 

e)  Occurrence  of  "multiple  counting,"  where  one  discharge  leads  to  a 
chain  of  one  or  more  following  discharges. 

These  dynamic  properties  are  a function  of  the  supply  voltage,  the 
tube  temperature,  the  values  of  circuit  resistance  and  capacitance  (stray 
or  intentional),  the  past  history  of  the  tube  with  respect  to  storage  and 
usage,  and  the  individual  tube — different  tubes  of  the  same  lot  number 
vary  somewhat  in  their  characteristics.  The  basic  design  problem  was  to 
devise  an  arrangement  which,  under  all  operating  conditions,  has  satis- 
factory sensitivity  and  freedom  from  false  alarms.  This  problem  was 
solved  by  a combination  of  tube  screening,  circuit  design,  and  signal 
processing . 

It  was  found  that  adequate  sensitivity  to  ultraviolet  radiation  could 
be  obtained  by  screening  the  sensor  tubes  at  worst-case  conditions  (see 
section  1.3).  Self-excitation  problems  were  eliminated  by  using  an  800- 
volt  square  wave  to  bias  the  sensor  tube,  rather  than  the  usual  direct 
current.  The  "multiple  count"  problem  was  greatly  alleviated  by  use  of  a 
nonretriggerable  monostable  circuit  which  is  triggered  by  the  first  pulse 
of  a train  of  pulses,  and  which  blanks  out  closely-following  pulses. 

The  longwave  response  problem  and  the  background-count  problem  were 
eliminated  by  additional  screening  of  the  sensor  tubes  and  by  use  of  a 
digital  pulse  counter*  This  counter  circuit  gives  an  output  signal  only 
if  eight  or  more  counts  are  received  from  the  sensor  tube  In  a period  of 
2.4  seconds. 
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Figure  4 shows  a simplified  schematic  of  the  circuitry  associated 
with  each  sensor  tube.  The  two  comparators  amplify  the  pulse  outputs  from 
the  sensor  tube  to  a standard  five-volt  level,  while  the  functions  of  the 
monostable  and  counter  circuits  were  described  above.  The  operation  of 
the  circuitry  is  described  more  fully  in  section  1.2  of  Chapter  IV. 

1.3  Sensor  Tube  Screening 

Edison  sensor  tubes  for  use  in  the  IFOS  are  screened  by  two  separate 
procedures.  One  procedure  is  to  insure  adequate  sensitivity  to  flame  and 
the  other  is  to  insure  adequate  freedom  from  false  alarms.  For  both  pro- 
cedures the  circuit  of  Figure  4 is  used,  with  an  electronic  digital  counter 
attached  to  point  X. 

To  screen  the  tubes  for  adequate  flame  sensitivity,  each  tube  is 
placed  with  its  electrodes  twelve  inches  from  a standard  propane  flame. 
(This  is  a flame  of  pure  propane  gas  burning  in  air,  the  gas  emitted 
through  a .02  inch  orifice,  and  with  pressure  adjusted  to  give  a flame 
1-3/4  inches  high.)  The  tube  is  operated  under  the  highest  design  temper- 
ature 260°C  (500°F)  and  the  lowest  design  supply  voltage  (750V),  since 
these  represent  worst-case  conditions  for  sensitivity  to  U/V  light.  Tubes 
are  accepted  for  service  only  if  they  supply  at  least  fifty  counts  per 
second  to  the  digital  counter. 

IFOS  specifications  require  that  the  system  respond  to  a five-inch 
diameter  gasoline  flame  four  feet  away  within  one-half  second.  Now  it 
has  been  found  that  a sensor  tube  which  gives  fifty  counts  per  second  from 
a standard  propane  flame  will  give  31.25  counts  per  second  from  the  above 
gasoline  flame.  In  one-half  second,  which  is  the  desired  maximum  response 
time,  about  sixteen  counts  would  result.  Thus,  a fire  alarm  would  be 
generated,*  as  only  eight  counts  are  needed  in  a 2.4  second  interval. 

Unfortunately,  there  are  some  complications  to  this  argument.  First, 
the  count  rate  is  subject  to  statistical  fluctuation,  due  in  part  to  the 
random  nature  of  photon  bombardment  of  the  sensor  tube.  Thus,  even  though 
the  average  sensitivity  of  the  sensor  tube  is  16  counts  per  .5  second, 
during  some  .5  second  intervals  less  than  16  counts  will  be  received. 
Second,  there  is  the  fact  that  every  2.4  seconds  the  digital  counter  of 
Figure  4 is  reset  to  zero.  Now  if  a fire  starts  just  before  the  reset 
pulse,  the  counter  might  be  reset  to  zero  before  eight  counts  are  accumu- 
lated, and  thus  perhaps  15  counts  would  be  required  in  the  .5  second 
period  to  give  a fire  alarm.  Third,  there  is  the  fact  that  the  clock  rate 
of  the  IFOS  might  possibly  differ  by  as  much  as  20%  from  the  design  -alue, 
changing  the  2.4  second  reset  time  to  1.92  seconds,  leading  to  a further 
lengthening  of  average  response  time.  Fourth,  one  must  take  into  account 
the  fact  that  the  system  is  disabled  (for  testing)  for  .12  seconds  every 
sixth  reset  time.  This,  too,  will  lengthen  average  response  time. 

By  assuming  that  the  counts  obtained  in  a given  time  interval  follow 
the  well-known  Poisson  distribution  function,  it  is  possible  to  calculate 


*It  is  here  assumed  that  the  other  sensor  tube  in  the  head  has  failed,  and 
thus  only  one  tube  is  needed  to  generate  the  fire  alarm. 
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the  probability  that  a fire  warning  will  be  obtained  within  .5  second. 
These  calculations  are  given  in  Appendix  I,  and  indicate  that  the  fire 
alarm  will  be  given  in  .5  second  94.3%  of  the  time.  To  confirm  these 
calculations,  a number  of  experimental  response  time  measurements  were 
made.  There  was  excellent  agreement  between  the  calculations  and  the 
measurements . 

Now  with  both  tubes  in  one  head  required  to  generate  an  output  for 
the  fire  signal  to  be  given,  the  probability  of  rapid  (.5  second)  response 
will  be  a few  percent  less,  since  a fire  signal  must  await  the  slower  of 
the  two  sensor  tubes.  But  with  two  separate  heads  responding  to  the  same 
fire  (the  normal  case),  the  probability  of  rapid  response  will  be  greater 
than  99%,  as  here  the  faster  head  will  generate  a fire  signal. 

It  should  be  noted  that  these  calculations  are  for  worst-case  con- 
ditions, where  the  sensor  tube  is  operated  at  maximum  temperature  and 
minimum  voltage.  It  is  also  assumed  that  the  sensor  tube  has  the  minimum 
acceptable  sensitivity,  and  that  the  fire  is  of  minimum  intensity  and 
maximum  distance  from  the  head.  Under  average  conditions,  response  to  a 
fire  will  be  obtained  within  .5  second  virtually  100%  of  the  time. 

To  screen  the  sensor  tubes  for  freedom  from  false  alarm,  each  tube 
is  placed  with  its  electrodes  twelve  inches  from  a light  source  which 
simulates  intense  sunlight.  (This  is  a 200  watt  tungsten-halogen  lamp 
with  a 2 mm  thick  Corning  054  filter.)  The  tube  is  operated  with  the 
highest  design  supply  voltage  (850V),  since  this  represents  worst-case 
conditions  for  the  generation  of  pulses  from  the  longwave  response,  from 
background  counting  and  from  self-excitation.  Tubes  are  accepted  for 
service  only  if  they  register  not  more  than  5 counts  in  a ten-second  test 
interval,  the  tests  being  made  at  both  -53.8°C  (-65*F)  and  260°C  (500eF) . 

Now  5 counts  in  ten  seconds  implies  1.2  counts  in  2.4  seconds,  where- 
as 8 counts  are  needed  to  generate  a fire  signal.  However,  again  there 
is  statistical  fluctuation  of  the  number  of  counts,  and  during  many  2.4 
seconds,  three  or  more  counts  will  be  received.  Further,  the  clock  rate 
of  the  IFOS  might  possibly  differ  by  20%  from  the  design  value,  changing 
the  2.4  second  receptive  time  to  2.88  seconds,  and  thus  increasing  the 
number  of  counts  registered. 

By  assuming  that  the  5 counts  per  ten  seconds  follows  a Poisson  dis- 
tribution, the  probability  of  a false  alarm  can  readily  be  determined. 

This  calculation  is  made  in  Appendix  II,  where  it  is  found  that  the 
average  time  between  false  alarms  is  6.04  hours  if  one  tube  can  generate 
a fire  alarm  and  46,000  hours  if  both  sensor  tubes  in  a given  head  are 
needed  to  generate  a fire  signal,  as  is  the  normal  condition.  With  six 
fully  functioning  flame  detector  heads  in  one  system,  the  average  time 
between  false  alarms  becomes  7,666  hours. 

It  should  be  noted  that  these  false  alarms  calculations  are  for 
worst-case  conditions.  Specifically,  it  was  assumed  that  the  sensor  tube 
barely  passed  the  screening  procedure,  that  it  was  operated  at  maximum 
supply  voltage,  and  that  it  was  pointed  directly  at  the  sun  when  the  sun 
was  directly  overhead.  Average  conditions  of  sunlight,  tube  voltage, 
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and  tube  screening  would  lead  to  far  larger  time  figures  than  those  given 
above . 


2.  U/V  SOURCE  LAMP 

2.1  In  order  to  periodically  test  the  Edison  U/V  sensor  tubes,  a U/V 
source  lamp  is  included  in  each  detector  head.  This  lamp  is  activated 
for  a .1  second  every  14. A seconds. 

At  the  start  of  this  program,  a satisfactory  source  lamp  could  not 
be  found,  and  so  it  was  necessary  to  develop  a suitable  lamp.  A special, 
high-f i lament-temperature  incandescent  lamp  was  considered,  but  it  was 
felt  that  a gas-discharge  lamp  would  be  more  reliable. 

Problems  encountered  in  the  design  of  this  discharge  lamp  included 
wandering  of  glow  spot  and  unstable  operation  at  260°C  (500°F).  Wandering 
of  the  glow  spot  results  in  variation  of  the  U/V  output  and  changes  in 
the  starting  voltage.  This  problem  was  overcome  by  adding  a nickel  cross- 
bar to  the  cathode  rod  and  by  covering  most  of  the  cathode  rod  with  glass 
beading.  Unstable  operation  at  high  temperature  was  eliminated  by  use  of 
a getter  to  absorb  certain  gas  impurities. 

The  final  design  of  the  source  lamp  is  shown  in  Figure  5.  A neon- 
argon  mixture  is  used  as  the  fill  gas. 

2.2  Developmental  Tests 

Two  lamps  were  put  on  continuous  operation  at  5 ma  life  test  at  260°C 
(500°F) . One  lamp  gave  approximately  the  same  U/V  output  at  214  hours 
operation  as  it  did  at  the  start.  The  U/V  output  of  the  second  life  test 
lamp  was  down  25%  after  266  hours  continuous  operation  at  26 0°C  (500°F). 
This  is  considered  more  than  adequate  as  one  hour  of  continuous  lamp  opera- 
tion is  equivalent  to  150  hours  of  system  operation  where  the  lamp  is 
energized  for  0.1  second  four  times  a minute.  Other  lamps  which  were  run 
on  pulsed  operation  at  260°C  (500°F)  for  up  to  64  hours  showed  negligible 
change  in  U/V  output.  A sample  of  the  lamps  was  also  evaluated  for  per- 
formance at  cold  temperature  and  no  appreciable  change  in  U/V  output  being 
noted  after  one  hour  continuous  operation  at  -54°C  (-65°F) . 

Two  U/V  source  lamps  together  with  a sensor  tube  were  vibrated  up  to 
500  CPS  at  15  g's  input  for  three  hours  in  each  of  three  orthogonal  planes. 
During  vibration  scanning  no  resonances  were  found;  and  there  were  no 
visible  mechanical  defects  or  degradation  of  the  lamp  or  sensor  tube  per- 
formance after  the  vibration. 

2.3  Lamp  Selection 

As  part  of  the  screening  process,  each  source  tube  is  pulsed  with  a 
300V  pulse,  .1  second  wide,  connected  through  a 37Kfl  resistor.  It  is 
placed  six  inches  away  from  a Mark  II  sensor  tube  of  minimum  acceptable 
sensitivity,  connected  into  the  circuit  of  Figure  4.  Acceptable  source 
tubes  must  give  at  least  fifty  counts  at  both  -54°C  (65°F)  and  260°C 
(+500°F). 
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Figure  5.  U/V  Source  Lamp 
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During  actual  IFOS  operation,  the  pulsed  source  tube  must  cause  each 
sensor  tube  to  give  at  least  eight  counts  for  that  tube  to  "test  good." 
Because  of  statistical  variations,  a source  tube,  which  causes  an  average 
count  of  fifty  per  .1  second,  will  sometimes  give  considerably  fewer 
counts.  By  assuming  a Poisson  distribution,  one  can  calculate  how  often 
fewer  than  eight  counts  will  occur.  This  calculation  is  made  in  Appendix 
III,  and  Indicates  a "mean  time  between  failures"  of  more  than  133  days  of 
continuous  operation.  Of  course,  since  worst-case  conditions  were 
assumed,  the  "mean  time  between  failures"  under  average  conditions  would 
be  much  greater. 

3.  HOUSING  DESIGN 

3.1  The  flame  detector  head  contains  two  Edison  U/V  sensor  tubes,  one  U/V 
source  lamp,  and  the  electronic  circuitry  shown  In  Figure  6. 

Shown  in  Figure  7 Is  the  detector  head  which  resulted  from  the  first 
design  attempt.  This  design  has  the  desirable  feature  of  requiring  light 
from  the  test  lamp  to  pass  through  the  same  windows  that  U/V  light  from  a 
flame  must  pass  through.  Thus,  if  these  windows  become  covered  with  oil  or 
dirt,  rendering  the  head  useless,  this  fact  will  be  detected  by  the  period- 
ical tests. 

The  Figure  7 head  was  built  and  successfully  passed  vibration  tests 
in  accordance  with  MIL-STD-810B.  It  was  then  decided  that  the  size  and 
weight  (3  lbs.  10  oz.)  of  this  design  were  too  large.  A reduced  size  head 
was  then  designed,  and  is  shown  in  Figure  8. 

To  carry  out  the  required  reduction  in  size,  it  was  necessary  to 
eliminate  the  desirable  feature  discussed  above,  where  the  light  from  the 
test  lamp  passes  through  the  windows.  (The  Air  Force  agreed  to  waive  this 
requirement . ) 

The  housing  is  constructed  of  passivated  stainless  steel.  Windows 
are  made  of  optical  grade  quartz,  sealed  and  cushioned  with  RTV8262  silicon 
rubber  adhesive/sealant.  Electronic  components  are  attached  to  a glass- 
bonded  mica  component  board  with  the  aid  of  the  RTV  sealant  and  a high- 
temperature  solder.  The  component  board  is  attached  to  the  housing  by 
means  of  screws  with  lockwashers.  Screws  and  safety  wire  are  used  to 
attach  the  cover.  Spot  welding  is  used  to  attach  the  mounting  brackets 
to  the  housing. 

The  detector  head  would  be  redesigned  as  a sealed,  welded  unit, 
thereby  removing  the  potting  material  from  direct  exposure  to  the  2000°C 
f lame . 

When  U/V  light  strikes  a sensor  tube,  the  ionization  process  within 
causes  U/V  light  to  be  emitted  from  the  tube.  This  light  can,  in  turn,  be 
detected  by  another  sensor  tube  in  the  vicinity.  Thus  the  two  tubes  in  the 
detector  housing  could  trigger  each  other.  Such  a coupling  is  very  undesir- 
able and  can  lead  to  false  alarms  being  given.  Thus,  each  tube  is  coated 
with  RTV  adhesive  in  such  a way  that  only  U/V  light  entering  through  the 
windows  or  from  the  test  lamp  will  also  enter  a sensor  tube. 
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Cathode  sputtering  in  the  test  lamp  can  cause  an  opaque  deposit  on 
the  glass  opposite  the  cathode  area.  The  test  lamp  is  positioned  in  such 
a way  that  this  deposit  will  not  block  U/V  light  to  the  sensor  tubes. 
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THERMISTOR  OVERHEAT  SENSOR 


1.  SENSOR  DESIGN 

Aircraft  overheat  detection  system  requires  sensors  which  provide 
safe  and  reliable  overheat  detection  with  a minimum  of  shorts  or  opens. 

The  sensor  used  in  this  contract  was  the  Edison  Model  244  which,  because 
> f its  ruggedness  and  operational  stability,  has  produced  an  excellent 
service  record  in  the  field. 

The  Edison  Model  244  sensor  is  of  coaxial  cable  construction  and 
consists  of  a tubular  dual-wall  outer  sheath,  a center  wire  and  a com- 
pacted temperature-sensitive  semiconductor  filler  material.  Operating 
cn  the  electronic  conduction  principle,  the  Edison  cable  does  not  depend 
on  any  physical  change  of  the  temperature-sensitive  material  within  the 
cable,  ensuring  therefore  excellent  operational  reversabi lity  which 
enables  the  cable  to  present  normal  and  overheat  conditions  repeatedly. 

2.  DESCRIPTION  OF  OPERATION 

The  semiconductor  material  contained  in  the  Edison  thermistor-type 
cable  is  a proprietary  blend  of  oxides  of  manganese  and  yields  a tempera- 
ture resistance  curve  with  a large  slope  which  enables  the  sensor  to 
detect  hot  spots  while  at  the  same  time  permitting  temperature  averaging 
to  evaluate  normal  high  ambient  temperati re  areas.  In  principle,  the 
filler  or  core  material  being  essentially  an  insulator  at  room  temperature, 
becomes  a good  conductor  when  heated  to  some  predetermined  higher  tempera- 
ture. Conduction  is  by  electrons  and  thus  the  sensor  resistance  can  be 
measured  by  application  of  a D.C.  voltage.  This  is  a distinct  advantage 
over  sensors  which  depend  upon  ionic  conduction  and,  therefore,  must  be 
operated  from  AC  voltages  and  are  more  sensitive  to  moisture. 

For  the  purpose  of  system  design  the  sensor  cable  is  considered  as 
a resistive  element  which  is  an  inverse  function  of  cable  temperature. 

3.  IMPEDANCE 

A common  way  of  testing  continuous  cables  is  to  expose  the  entire 
length  to  a predetermined  oven  temperature  and  measure  cable  impedance 
between  center  wire  and  sheath  with  an  ohnmeter.  This  technique  suffices 
as  an  acceptance  test  of  a finished  cable  because  any  abnormally  low 
resistance  section  along  the  cable  length  registers  markedly  on  the  total 
parallel  impedance. 

By  performing  this  procedure  on  one  small  section  of  the  cable  at  a 
time,  along  the  entire  cable  length,  data  from  excessively  high  or  low 
resistance  sections  will  not  conceal  or  overshadow  normal  temperature 
characteristics,  or  variations  in  these  characteristics  arising  from  vari- 
ations in  fabrication  or  processing. 
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^andard  practice  at  tdison  is  to  test  a six-inch  section  every  two 
feet  along  the  length  ol  the  cable.  This  technique  yields  an  accurate 
profile  of  cable  resistance  and  reveals  all  but  the  most  localized  resis- 
t;ve  extreme-.  Normal  variations  in  resistance  are  generally  due  to  non- 
uni  t orrr.l  tv  of  the  cable  cross  section  along  its  cable  length  causing 
variations  in  filler  thickness.  alized  variations  in  cable  resistance 

rr.av  be  me  t moisture  ingress  at  a It  ikv  end  seal,  inhomogeneities  in 
the  oxide  nix  or  loss  of  a chip  of  oxide  from  the  extrusion. 

Pi  ts  ol  able  resistivity  (ohm-feet)  versus  temperature  for  a 
farilv  or  cables  with  var  as  character! stic  temperatures  (the  temperature 

at  which  the  resistivity  l 100  ohm-ft.)  are  shown  in  Figure  9. 

The  relation  between  resistance  and  temperature  is  similar  to  the 
resi-tunce  r ianv  the’cristor-t  pe  semiconductors  over  considerable  ranges. 
The  resistance  at  a given  temperature  can  be  determined  accurately  by  the 

equation: 


whe  re 


R0  exp (B/T) 


T * absolute  temperature  in  Degrees  Rankine 
R » resistance  in  ohm-feet  at  temperature  T 
Rn  = constant  in  ohm-feet 

B = slope  of  the  temperature  resistance  characteristic 


Here  cable  resistance  increases  to  a very  high  level  but,  being 
limited  bv  the  electrophysical  properties  of  this  cable,  does  not  become 
infinite  as  the  equation  would  imply.  As  temperature  approaches  infinity, 
the  minimum  value  of  cable  resistance  is  limited  by  the  resistance  of  the 
center  wire  and  sheath  and  does  not  become  zero. 
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COMPUTER  CONTROL  UNIT 


The  computer  control  unit  has  the  function  of  correlating  signals 
from  the  dual  overheat  sensor  cables  and  from  the  six  radiation  detector 
heads  in  accordance  with  predetermined  operational  constraints  and  provid- 
ing signals  to  the  crew  readout  unit  and  to  the  maintenance  warning  unit. 

The  computer  control  unit  contains  a transient  suppressor  network,  a power 
supply  regulator,  voltage  monitors,  a clock  as  well  as  signal  processing 
and  correlating  circuitry  for  both  the  overheat  and  radiation  sensors. 

The  computer  control  unit  was  designed  to  operate  in  an  ambient  temperature 
range  of  -40°C  (-40°F)  to  85"C  (185°F)  in  a military  environment.  The  de- 
tailed specific  requirements  of  the  computer  control  unit  are  delineated 
in  Section  I of  this  report. 

Much  of  the  signal  processing  circuitry  is  of  the  digital  type, 
based  on  TTL  integrated  circuits.  Positive  logic  is  used  to  describe  the 
operations  involved,  and  so  a Boolean  ONE  indicates  voltage  levels  in  the 
range  from  2.0V  to  5.5V,  while  a Boolean  ZERO  Indicates  voltage  levels 
f rom  OV  to  . 8V . 

1.  FIRE  AND  FIRE-FAIL  SECTION 

1.1  As  discussed  in  the  Introduction,  fire  detection  is  achieved  by  the 
employment  of  six  flame  detector  heads.  Each  head  contains  two  U/V  sensor 
tubes  and  a U/V  source  lamp  for  testing  the  sensors.  A fire  warning  should 
be  generated  when  both  sensors  in  any  head  have  tested  good  and  when  both 
give  an  output  signal  resulting  from  fire  U/V  radiation  striking  he  sen- 
sors. An  output  signal  from  only  one  sensor  should  not  result  in  a fire 
warning  unless  the  other  sensor  in  the  head  failed  to  respond  to  tne  test 
lamp  during  the  most  recent  test. 

To  provide  a high  degree  of  reliability  against  false  alarms  and  fire 
detection  failures,  fire  signal  flow  is  carried  from  the  U/V  sensors  to  the 
signal  processors,  fire  warning  logic,  fire-fail  logic,  and  computer  diag- 
nostic logic  in  twelve  parallel  channels. 

1.2  U/V  Signal  Processors 

Schematic  diagrams  for  the  U/V  signal  processors  are  found  in 
Figure  10.  These  processors  consist  of  twelve  identical  circuits,  six 
located  on  each  of  two  printed-circuit  boards,  designated  A3  and  A4.  The 
operation  of  the  circuit  for  signal  UV11  (from  head  1,  sensor  tube  1)  is 
described  below. 

When  tube  11  is  struck  by  U/V  light,  it  develops  positive  and  nega- 
tive pulses  across  its  182Q  load  resistor  (see  Figure  6),  located  in  head 
one.  The  amplitude  of  these  pulses  is  about  250mv  with  random  pulse  widths 
varying  up  to  a maximum  of  one-half  of  the  period  of  the  800V  square  wave 
used  to  bias  the  sensor  tube.  These  pulse  signals  are  transmitted  through 
a coaxial  cable  to  terminal  12  of  board  A3. 
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The  dual  comparators  labeled  U5  both  amplify  and  rectify  the  signal 
pulses.  Their  outputs  are  "wired-ORed"  together,  and  consist  of  five- 
volt  negative-going  pulses  based  at  +5V.  Resistors  Rl,  R2,  R4  and  R5  back- 
bias  the  comparator  inputs  to  eliminate  signals  of  magnitude  150mv  or 
less.  (Such  signals,  not  originating  in  the  sensor  tube,  might  result 
from  undesired  coupling  to  other  circuits.) 

Output  pulses  from  the  comparators  are  applied  to  the  input  of  a 
nonretriggerab le  monostable,  U5.  (U5  is  physically  located  on  A5,  the 

"Reset"  board.)  This  monostable  converts  all  input  pulses  to  output 
pulses  of  a uniform  width,  namely  1/3  msec.  The  nonretriggerable  feature 
alleviates  much  of  the  "multiple-count"  problem  (see  section  1.2  of  Chap- 
ter II).  Here,  the  first  pulse  of  a train  of  pulses  triggers  the  mono- 
stable, which  then  has  no  response  to  the  following  pulses  for  at  least 
1 . 3 msec . 

Under  certain  conditions,  the  input  to  the  monostable  consists  of  a 
group  of  fifteen  pulses  originating  from  the  Fire  Warning  circuits.  These 
pulses,  labeled  T211,  are  coupled  into  the  signal  processor  circuit  by 
means  of  a "wired-OR"  connection.  Since  the  time  between  each  two  pulses 
is  one  m sec.  and  the  period  of  the  monostable  is  1.3  msec.,  these  fifteen 
input  pulses  result  in  only  eight  output  pulses. 

The  next  components  in  the  signal  path  are  a ripple  binary  counter 
(U3)  and  an  associated  NAND  gate,  Ul.  An  output  pulse  results  from  the 
NAND  gate  only  after  eight  input  pulses  to  the  ripple  counter.  A reset 
signal,  labeled  T RESET,  is  applied  to  the  counter  every  2.4  seconds, 
and  so  the  NAND  will  have  an  output  signal  only  if  the  eight  input  pulses 
are  received  in  the  period  between  the  reset  pulses.  It  is  this  circuitry 
which  prevents  a false  fire  signal  resulting  from  long-wave  response,  back- 
ground count  and  self-excitation  of  the  sensor  tube. 

Pulses  from  the  Ul  NAND  gate  are  used  to  trigger  the  retriggerable 
monostable  U2.  Components  Cl,  C2  and  R13  set  the  period  of  U2  to  1.3 
seconds.  If  U2  receives  input  pulses  not  more  than  1.3  seconds  apart,  it 
will  provide  a constant,  steady  output  which  is  insensitive  to  the  random 
variations  in  the  times  between  individual  input  pulses. 

Monostable  U2  is  reset  by  the  signal  T'  RESET.  This  signal  is  a 
double  pulse  occuring  every  14.4  seconds.  The  first  pulse  resets  U2  just 
before  the  test  source  lamp  is  pulsed,  and  the  second  pulse  resets  U2 
.12  seconds  later,  so  that  no  fire  indication  is  given  as  a result  of  the 
test. 

1.3  Fire  Warning  Circuits 

Schematic  diagrams  for  the  fire  warning  circuits  are  found  in 
Figure  11.  (This  drawing  strictly  describes  the  circuitry  on  the  A6 
printed-circuit  board.  The  circuitry  on  the  A7  board  is  identical  except 
for  nomenclature.) 

The  fire  warning  circuitry  is  divided  into  six  identical  blocks — 
one  block  for  each  detector  head.  Further,  each  block  has  a symmetry 
where  each  half  corresponds  to  one  U/V  fire  signal  channel. 
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natic  Wiring  Diagram,  Fire  Fail  Logic  - U/V  Detectors 


29/30 


Each  of  the  six  blocks  of  circuitry  uses  four  timing  signals,  which 
are  shown  in  Figure  12  for  easy  reference.  Note  that  the  four  flip-flops 
in  each  block  are  of  the  "D"  type,  the  preset  and  clear  inputs  are  not 
used,  and  date  transfer  takes  place  on  a low-to-high  transition  of  a clock 
pulse . 

Consider  the  block  of  circuitry  dealing  with  detector  head  number 
one.  The  Inputs  to  this  circuitry  are: 

1.  The  four  timing  signals  of  Figure  12,  namely  Tl,  T,  T* , and  T2. 

2.  Boolean  signals  from  the  U/V  signal  processors,  namely  UV11  and 
UV12.  A boolean  value  of  ONE  indicates  that  the  corresponding 
sensor  tube  has  responded  to  U/V  light. 

The  outputs  from  this  circuitry  are: 

1.  Ql:  A value  of  ONE  indicates  that  at  least  one  of  the  two  sig- 

nal channels  has  tested  good  and  that  a fire  has  been  detected. 

2.  T211  and  T212:  If  a response  to  the  test  lamp  in  the  detector 

head  is  not  obtained,  these  pulses  are  sent  back  to  the  U/V  signal 
processors  to  determine  whether  the  fault  is  a defective  sensor 
tube  or  defective  circuitry. 

3.  Vll  and  VI 2:  A value  of  ONE  Indicates  that  no  response  was  ob- 

tained from  the  test  lamp. 

4.  VM11  and  VM12:  A value  of  ONE  indicates  that  a response  was 

obtained  from  T211  and  T212  test  pulses,  but  not  from  the  test 
lamp.  It  is  these  signals  which  activate  the  UV  indicators  of 
the  MWU . 

5.  VCUV11  and  VCUV12:  A value  of  ONE  indicates  that  no  response 

was  obtained  from  the  test  pulses.  Any  VCUV  signal  becoming  a 
ONE  will  make  the  CUV  signal  a ZERO,  to  indicate  a failure  in  the 
electronic  circuitry  (CUV  stands  for  "computer,  ultraviolet"). 

To  explain  the  functioning  of  this  circuitry,  operation  under  four 
different  conditions  is  described  in  detail.  Again,  the  description  is 
given  for  the  circuitry  associated  with  head  number  one.  The  integrated- 
circuit  packages  U1  and  U2  each  contain  two  flip-flops,  and  so  the  expres- 
sions "upper  half"  and  "low  half"  will  be  used  to  refer  to  specific  flip- 
f lops . 

1.3.1  Condition:  There  are  no  defective  components  and  no  fire  is  de- 

tected. At  t = 0,  the  test  lamp  comes  on  for  105  msec.  This  causes  UV11 
and  UV12  to  become  ONE  for  about  120  msec.  At  the  end  of  Tl  (t  « 105  msec.), 
the  upper  halves  of  U1  and  U2  are  set  (Q  = 1),  and  at  the  end  of  T (t  ■ 120 
msec.)  the  lower  halves  of  U1  and  U2  are  set.  Then  UV11  and  UV12  become 
ZERO,  but  all  four  flip-flops  remain  set.  Ql , Vll,  V12,  VM11 , VH12,  tCCVH, 
and  VCUV12  are  all  ZERO,  CUV  is  ONE,  and  no  T211  or  T212  pulses  are  gated. 
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1.3.2  Condition:  There  are  no  defective  components  and  a fire  is  detected 

UV11  and  UV12  become  ONE.  All  four  flip-flops  have  been  previously  set, 
as  described  in  1.3.1.  This  causes  ZEROs  to  appear  on  pins  6 and  8 of  U8, 
ONEs  to  appear  on  pins  8 and  12  of  U13,  and  ZERO  to  appear  at  pin  8 of  U14 
and  hence  a ONE  to  appear  at  pin  8 of  U7.  This  is  the  Q1  * ONE  signal. 

1.3.3  Condition:  Sensor  tube  number  two  in  head  number  one  is  defective, 

and  does  not  generate  an  output  when  illuminated  by  the  test  lamp.  At  the 
end  of  105  msec.,  with  UV12  ■ 0,  the  upper  half  of  U2  is  cleared.  T2 
pulses  are  then  gated  through  U8,  coming  out  on  pin  3 as  T212  pulses, 
which  go  back  to  channel  two  on  the  U/V  signal  processor  board.  These 
pulses  in  turn  make  UV12  * ONE,  so  that  at  the  end  of  T (t  = 120  msec.) 
the  lower  half  of  U2  is  not  cleared.  With  the  upper  half  of  U2  not  set, 
V12  is  a ONE,  and  after  T*  again  becomes  ONE,  pin  6 of  U17  becomes  ZERO, 
resulting  in  VM12  = ONE.  If  a fire  were  to  occur  now,  the  Q1  output  would 
be  obtained  via  pin  12  of  U7. 


1.3.4  Condition:  There  is  a defect  in  the  electronics  in  channel  number 

one  in  the  U/V  signal  processor,  such  that  UV11  is  always  ZERO.  Here,  by 
t = 120  msec.,  both  halves  of  Ul  have  been  cleared,  as  UV11  remained  zero 
in  spite  of  the  injection  of  T211  pulses.  With  both  halves  of  Ul  at  the 
Q = 0 state,  Vll  = ONE,  VCUV11  = ONE,  and,  through  the  action  of  the  U19 
inverters,  CUV  = ZERO.  If  a fire  were  to  occur  now,  the  Q1  output  would 
be  obtained  via  pin  6 of  U7. 


1.4  Fire  Fail  Warning  Logic 

The  schematic  diagram  for  the  fire  fail  warning  logic  is  found  in 
Figure  13. 

This  circuitry  performs  three  functions:  It  develops  a fire  warning 

signal,  a fire  fail  warning  signal,  and  inhibits  the  T'  RESET  signal  to 
the  U/V  signal  processors  during  fire  conditions. 

Consider  first  the  fire  warning  circuitry.  The  six  fire  signals,  Q1 
...  Q6,  from  the  fire  warning  logic  are  combined  in  an  OR  relationship  by 
the  circuits  of  U13  and  U7.  Thus  the  signal  on  pin  8 of  U7  is  a ONE  if  any 
of  the  flame  dectector  heads  senses  a fire.  Pin  5 of  U18  follows  pin  8 of 
U7,  except  that  a ONE  cannot  be  "passed  through"  during  test  time.  This 
inhibition  is  due  to  applying  the  signal  T*  (see  Figure  10)  to  pin  4 of  U9, 
and  is  needed  because  the  signals  Q1  ...  Q6  normally  become  ONE  during  test 
time.  The  fire  signal  is  then  passed  through  a gate  and  an  inverter  and 
appears  on  pin  5 of  the  printed-circuit  board  connector.  The  gate  just 
mentioned  inhibits  this  signal  if  a "fire  fail  warning"  signal  is  present. 
The  net  effect  of  this  circuitry  is  to  implement  the  Boolean  expression. 

FW  = FFW  T*  (Q1  + Q2  + Q3  + Q4  + Q5  + Q6). 

Consider  now  the  fire  fail  warning  circuitry.  IFOS  specifications 
require  that  the  CCU  generate  a fire  fail  warning  signal  when  any  two 
adjacent  heads  fail  (see  section  3.2  of  Chapter  I).  This  is  accomplished 
by  first  combining  the  twelve  signals  Vll,  Vl2  . . . V62  from  the  fire 
warning  circuits  with  six  4-input  NAND  circuits.  Thus  if  detector  heads 
one  and  two  failed,  signals  Vll,  Vl2,  V21  and  V22  would  all  be  ONE,  and 
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and  an  output  ZERO  would  appear  on  pin  8 of  U5.  The  circuits  Ull  and  U17 
combine  the  outputs  of  the  six  NAND  gates  to  give  an  OR  function.  (The 
signal  on  pin  6 of  Ull  presently  performs  no  useful  function.)  The  over- 
all function  of  the  fire  fail  warning  circuitry  is  to  implement  this  ex- 
pression: 

FFW  = Vll  V12  V21  V22  + V21  V22  V31  V32 

+ V31  V32  741  V42  + V41  V42  V51  V52 

+ V51  V52  V61  v"62  V61  V62  Vll  \fl2 

T'  RESET  is  inhibited  by  the  fire  warning  signal  by  means  of  the 
upper  half  of  the  NAND  gate  Ul. 

1.5  Driver  Circuitry 

Figure  14  shows  the  schematic  diagram  for  this  circuitry. 

Resistors  R1  to  R12  are  "pull  up"  resistors  for  the  open-collector 
inverters  of  the  fire  warning  circuits.  The  cascaded  Inverters  are  used 
to  amplify  the  fire  warning  signal  before  it  is  sent  to  the  CRU. 

2.  OVERHEAT  AND  OVERHEAT-FAIL  SECTION 
2.1  Basic  Approach 

To  provide  reliability  against  false  alarms  and  overheat  detection 
failures,  redundancy  is  used  for  both  the  sensors  and  the  electronics. 
Also,  the  electronics  is  periodically  tested  for  both  false  ON  and  false 
OFF. 


The  overheat  system  consists  of  two  sensor-computer  channels  (sensor 
loop  A - Channel  A and  sensor  loop  B - Channel  B)  whose  outputs  are  directed 
to  the  display  units.  Each  alarm  channel  consists  of  a sensor  cable  loop, 
both  ends  of  which  are  connected  to  a corresponding  signal  processor  in 
the  computer  control  unit.  Signal  processor  output  is  in  turn  applied  to 
a fault  evaluation  circuit,  an  output  circuit  and  a signal  correlator  cir- 
cuit which  is  common  to  both  overheat  alarm  channels  and  the  U/V  portion 
of  the  system. 

Even  though  the  range  of  sensing  element  circuit  resistance  in  which 
an  overheat  alarm  may  be  signalled  includes  resistance  values  that  could 
be  produced  by  partial  shorts  in  the  sensor  cable,  connectors,  or  wiring, 
the  computer  control  unit  is  capable  of  discriminating  between  an  overheat 
or  a partial  short  condition. 

Sensor  cables,  having  thermal  mass,  do  not  react  instantly  to  varia- 
tions in  temperature  while  a large  majority  of  shorts,  absolute  or  partial, 
take  on  the  character  of  a step  input  change  in  cable  resistance. 

In  the  course  of  this  program,  it  was  decided  that  the  technique  of 
examining  and  comparing  the  outputs  of  a group  of  signal  processor  ampli- 
fiers, connected  by  way  of  a bridge  network  to  each  sensor  cable,  in  the 
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time  domain  was  an  effective  means  by  which  sensor  short  discrimination 
could  be  accomplished.  In  addition,  the  periodic  application  of  test 
pulses  to  both  sensor  cable  and  signal  processor  circuitry  was  found  to 
be  an  effective  means  for  monitoring  the  status  of  sensor  cable  continuity 
against  opens  and  shorts  and  the  status  of  amplifier  operation  against 
electronic  faults  appearing  as  false  ON's  and  false  OFF's. 

Three  amplifier  channels  are  by  way  of  bridge  circuit  detection  net- 
works linked  to  each  sensor  to  obtain  the  signals  for  sensor  cable  and 
signal  processor  status.  These  are  designed  as  Al,  A2  and  A3  for  sensor 
loop  A and,  in  like  manner,  Bl,  B2  and  B3  for  sensor  loop  B. 

Amplifier  A2,  containing  an  input  delay  network,  operates  in  con- 
junction with  Al  to  determine  the  existence  of  either  an  overheat  condi- 
tion or  a cable  short.  Here,  on  a steady  state  basis,  A2  is  so  set  as  to 
become  activated  at  a slightly  lower  sensor  temperature  than  Al.  Thus  for 
overheat  conditions  A2  would  be  actuated  before  Al.  This  condition  is 
symbolized  by  the  term  A21  which  is  monitored  during  normal,  no-test,  time. 
Amplifier  A3  is  used  with  Al  and  A2  to  aid  in  determining  the  status  of 
cable  circuit  continuity. 

In  the  course  of  this  work,  it  was  found  necessary  to  periodically 
apply  two  test  pulses  (TC12  and  TC22)  to  provide  a continuous  and  auto- 
matic check  of  both  sensor  cable  and  signal  processor  status.  Here  over- 
heat detection  occurs  during  the  14.86  second  (nominal)  no-test  interval. 
Once  detected,  the  condition  of  overheat  is  memorized  and  cuts  out  over- 
heat fail  and  cable  fail  circuitry,  preventing  their  display. 

The  operational  continuity  of  sensor  cable  A and  alarm  amplifiers 
Al  and  A2  is  checked  by  applying  a turn-on  pulse  TC12  to  the  input  cir- 
cuitry of  Al  and  A2  by  way  of  cable  A.  The  operational  continuity  of 
amplifier  A3  is  checked  by  the  direct  application  of  TC12  to  the  input 
circuit  of  A3.  The  pulse  width  of  TC12  is  approximately  45  milliseconds 
long. 


Pulse  TC22  is  a turn-off  pulse  which  starts  approximately  60  milli- 
seconds after  the  end  of  TC12,  and  is  approximately  35  milliseconds  wide. 
It  is  applied  directly  to  the  inputs  of  Al,  A2  and  A3,  and  is  used  to 
detect  cable  shorts  and  amplifier  faults  appearing  as  a false  ON. 

A shorted  cable  occurring  any  time  actuates  Al  and  A2.  This  condi- 
tion is  detected  at  the  conclusion  of  turn-off  pulse  TC22,  and  during  the 
beginning  of  the  normal  no-test  period. 

2.2  Description  and  Operation 

From  input  to  output  each  alarm  channel  contains  a Wheatstone  bridge 
type  detection  network  operating  in  conjunction  with  a three  amplifier 
channel  signal  processor,  a cable  and  signal  processor  fault  differentiat- 
ing board,  and  an  output  board.  The  per-channel  output  boards  operate  in 
conjunction  with  a signal  correlator  board  which  is  common  to  both  over- 
heat channels  to  provide  signals  to  the  Crew  Readout  Unit  for  the  genera- 
tion of  OVERHEAT  FAIL  warnings  and  signals  to  the  Maintenance  Warning  Unit 


for  Che  generation  of  cable  and  signal  processor  fall  warnings.  Here, 
the  signal  correlator  also  combines  sensor  cable  fault  signals  and  signal 
processor  fault  signals  with  fail  terms  from  clock  monitor  and  voltage 
monitor  circuitry,  used  by  the  entire  computer  control  unit,  for  the 
production  of  overheat  fail  warning  signals.  In  an  analogous  manner, 
the  signal  correlator  also  provides  fire-fail  warning  signals. 

The  overheat  portion  of  the  computer  control  unit  obtains  its  power 
from  aircraft-type  unregulated  28VDC,  and  is  transient  protected  by  a 
choke-zener  diode  transient  suppressor  network.  Plus  five  volts  from  a 
switching  regulator  and  minus  five  volts  from  a DC/DC  converter  and 
linear  regulator  circuit  provide  logic  power  to  both  channels  from  input 
to  output.  The  computer  control  unit  signal  correlator  obtains  its 
power  from  the  five  volt  reference  supply. 

2.2.1  Signal  Processor 

As  can  be  seen  in  Figure  15,  both  ends  of  the  sensor  cable  are  con- 
nected to  the  input  circuit.  Here,  one  end  of  the  center  conductor  is 
connected  to  bridge  resistor  R1  and  the  three  amplifier  channels  Al,  A2, 
and  A3.  The  other  end  of  the  center  conductor  is  connected  to  an  open 
collector  inverter  U2-1  which,  when  activated  by  turn-on  pulse  TC12, 
connects  the  center  conductor  to  ground  potential  by  way  of  test  resistor 
R5.  Both  ends  of  the  outer  sheath  of  the  sensor  cable  are  connected  to 
the  bottom  of  the  detector  bridge.  A return  wire  connected  to  the  sensor 
cable  sheath  is  brought  back  to  power  common  by  way  of  terminal  1.  This 
configuration  represents  the  detector  portion  of  this  bridge  where  R1 
is  the  upper  leg  and  sensor  cable  center  wire-to-sheath  resistance  is  the 
lower  leg.  Resistors  R2  and  R6,  R3  and  R7,  and  R4  and  R8  are  the  upper 
and  lower  bridge  set  point  legs  for  amplifier  channels  Al,  A2,  and  A3, 
respectively. 

Channel  A,  consists  of  one-half  of  dual  comparator  integrated  cir- 
cuit chip  Ul.  Channel  A2  consists  of  an  input  stage  (the  other  half  of 
dual  comparator  Ul) , a delay  network  consisting  of  resistor  R21  and 
capacitance  C26  and  C27  and  an  output  stage  consisting  of  one-half  of 
dual  comparator  U3.  Channel  A3  consists  of  one-half  of  dual  comparator 
U4 . 

All  of  the  amplifiers  connected  to  the  bridge  circuit  contain  posi- 
tive hysteresis  networks  and  R-C  filters  for  protection  against  spurious 
noise  voltages  existing  on  the  sensor  cable. 

Since  upper  bridge  resistors  Rl,  R2,  R3  and  R4  have  the  same 
resistance,  lower  set  point  resistors  R6,  R7,  and  R8  will  represent  the 
center  wire-to-sheath  resistance  at  which  inputs  to  amplifier  channels  Al, 
A2,  and  A3  will  be  zero  excluding  the  effect  of  positive  hysteresis  cir- 
cui try . 

Thus  as  sensor  cable  temperature  increases,  cable  resistance  de- 
creases and  as  it  passes  through  270  ohms,  for  example,  signal  voltage 
across  terminals  of  Ul-2  increases  from  a negative  value  through  zero  to 
a positive  value  causing  in  turn  a positive  going  output  from  terminal  8 
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Figure  15.  Schematic  Wiring  Diagram,  0/ 
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of  Ul.  This  output  voltage  is  applied,  by  way  of  the  delay  network,  to 
comparator  U3-1  which  supplies  signal  processor  output  A2. 

As  cable  resistance  decreases  further  and  passes  through  220  ohms, 
signal  voltage  across  dual  comparator  Ul-1  becomes  positive  and  supplies 
signal  processor  output  Al  without  the  time  delay  experienced  by  A2. 

For  center  conductor  to  outer  sheath  partial  shorts  of  less  than  220 
ohms,  Al  will  be  activated  before  A2  (A12)  at  the  end  of  turn  off  pulse 
TC22  and  the  beginning  of  the  normal  no-test  period  whereas  for  gradual 
changes  in  cable  resistance  due  to  an  overheat  condition,  A2  will  be 
activated  before  Al  (A21).  This  is  the  manner  in  which  cable  shorts  are 
differentiated  from  true  overheat  conditions. 


In  a manner  similar  to  Al,  channel  A3  output  is  present  when  center 
wire  to  cable  resistance  reaches  a value  lower  than  63  ohms  which  is 
viewed  as  a direct  short. 


By  way  of  inverters  U2-2  and  U2-3  and  transister  Ql,  turn  on  pulse 
TC12  is  also  applied  directly  to  comparator  U4-1,  which  presents  amplifier 
channel  A3  output. 


Turn-on  pulse  TC12  is  applied  to  inverter  U2-1  which  then  connects 
the  open  side  of  the  sensor  cable  center  wire  to  ground  potential.  The 
result  of  this  test  is  that  both  amplifier  channels  Al  and  A2  are  now 
activated  by  way  of  the  cable.  Should  an  open  circuit  exist  in  center 
wire  circuitry,  these  amplifiers  would  not  be  activated.  Thus,  for  an 
open  in  sensor  cable  A,  the  single  fault  logic  displayed  by  Al,  A2 , and 
A3  during  TC12  would  be 

Al  A 2 A3  TC.l  2 TC22 

0 0 11  0 

The  comprehensive  truth  table  for  the  overheat  system  is  included  as 
Appendix  IV. 


Turn-off  pulse  TC22  starts  approximately  60  milliseconds  after  the 
end  of  TC12  and  is  used  to  detect  cable  shorts  and  amplifier  faults 
appearing  as  a false  ON. 


As  seen  in  Figure  15,  non- inverting  inputs  Ul-1,  Ul-2  and  U4-1  are 
joined  by  the  way  of  isolation  diodes  CR1,  CR2,  and  CR3,  respectively,  to 
a voltage  divider  network  consisting  of  resistor  R33,  diodes  CR4  and  CR5 , 
and  resistor  R34.  Here  comparator  U4-2  is  connected  to  the  junction  of 
R33  and  CR4  and  is  used  as  a voltage  level  shifter  which  during  the  no- 
test state  provides  a positive  bias  to  the  divider  network  keeping  isola- 
tion diodes  CR1,  CR2,  and  CR3,  in  an  off-biased,  non-conducting  state. 

In  this  no-test  state  all  channels  are  thus  permitted  to  operate  in  a 
standard  monitoring  mode.  When  turn-off  test  pulse  TC22  is  applied  to 
U4-2 , the  amplifier  shifts  the  bias  voltage  on  the  voltage  divider  from 
plus  to  minus,  diodes  CR1,  CR2,  and  CR 3 conduct  current,  and  the  input 
amplifiers  of  channels  Al,  A2 , and  A3  are  turned  off.  Should  any  ampli- 
fier channel  remain  in  an  on  state,  this  condition  will  be  diagnosed  by 
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fault  circuitry  as  a signal  processor  fault.  If  Al,  for  example,  remained 
ON  the  logic  pattern  presented  would  be  as  follows: 

Al  A2  A3  TCI 2 TC22 

1 0 0 0 1 

This  condition  would  then  be  evaluated  as  an  electronic  fault  in 
signal  processor  A.  Information  of  this  condition  would  be  applied  both  to 
the  Maintenance  Warning  Unit  where  the  CCU  light  would  be  turned  on,  and  to 
the  Crew  Readout  Unit  where  it  would  be  stored  as  an  overheat  fail  in  chan- 
nel A (OHFA)  for  future  operation  with  other  signals. 

Should  amplifiers  Al  and  A2  be  in  an  ON  state  because  of  either  an 
overheat  condition  or  a cable  short,  they  would  be  turned  off  periodically 
by  the  application  of  TC22.  Since  A2  has  an  input  delay,  the  end  of  TC22 
and  beginning  of  the  no-test  period  would  cause  first  Al  and  then  A2  to  be 
reactivated  into  an  on-state  (A12) . However,  if  Al  and  A2  were  turned  on 
by  an  overheat  condition  (A21),  occurring  during  the  preceding  no-test 
period,  the  existing  overheat  signal  and  display  would  be  maintained.  If, 
on  the  other  hand,  no  overheat  condition  exists,  then  the  signal  caused  by 
A12  would  be  allowed  to  generate  both  a CFA  display  in  the  Maintenance 
Warning  Unit,  and  store  an  overheat  fail  signal  for  channel  A (OHFA)  in  the 
Crew  Readout  Unit  where  it  would  block  a corresponding  overheat  signal. 

The  logical  presentation  of  a cable  short  at  the  end  of  TC22  and  the  be- 
ginning of  no  test  is  presented  as  follows: 

Al  A2  A3  T12  T22 

110  0 0 

where  the  sequence  of  Al  and  A2  (A12)  is  sensed. 

2.2.2  Cable  and  Signal  Processor  Fault  Diagnostic  Circuitry 

The  truth  table  shown  in  Appendix  IV  represents  all  the  possible 
states  of  signal  processor  output  and  test  modes,  any  one  of  which  can 
exist  at  a particular  time.  It  is  important  to  note  that  further  logic 
considerations  have  to  be  made  to  accommodate  the  existence  of  a more  than 
one  event,  that  is,  a chain  of  events  each  of  which  is  represented  by  its 
particular  line.  As  will  be  discussed  later,  one  solution  that  is  employed 
is  the  concept  of  first-come  first-serve  priority  logic. 

This  concept  is  employed  in  both  the  cable  and  signal  processor 
fault  board  and  the  output  board  to  enable  decision  making,  and  in  the 
Crew  Readout  Unit  to  memorize  warnings  of  OVERHEAT  or  OVERHEAT  FAIL  with 
certainty. 

2. 2. 2.1  Cable  Fault 

A study  of  the  truth  table  in  Section  IV  for  the  logic  expression 
denoting  a fault  in  cable  A,  results  in  the  analysis  of  a number  of  lines. 
When  simplified,  the  logic  equation  for  cable  fault  A (CFA)  becomes 

CFA  = A12  TCI?  TCT7  4 XT  A?  A3  TC12  TCI7 
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where  the  first  term  denotes  a cable  short  (A1  occurring  before  A2)  found 
during  no-test,  and  the  second  term  denotes  an  open  cable  found  during 
TC12 . (Refer  to  Figure  16.) 
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Cable  short  status  and  cable  open  circuit  status  are  applied  to  NAND 
gate  U4-4.  This  element  is  a NAND  gate  for  logical  ONE  inputs  but  can  be 
used  as  a NOR  gate  for  logical  ZERO  inputs.  Normal  no-fault  states  are 
presented  as  logical  ONE's  to  the  input  of  this  gate  and  result  in  a nor- 
mal no-fault  logical  ZERO  at  output.  The  occurrence  of  either  cable  fault, 
however,  will  cause  either  logical  ONE  input  to  be  changed  to  a logical 
ZERO  and  result  in  a CFA  logical  ONE  at  the  output  terminal. 

The  sensor  cable  short  condition  A12  TClT  TC22  is  detected  by  J-K 
flip-flop  U8-1  and  is  applied  in  the  form  YCJ2  TC'22  A12  to  set  terminal  1 
of  the  latch  consisting  of  NAND  gates  U6-1  and  U6-2.  By  way  of  inverter 
Ul-6,  the  inverse  is  applied  to  input  terminal  of  U4-4.  For  the  normal 
no-fault  state,  both  flip-flop  and  latch  are  maintained  in  a reset  condi- 
tion by  a reset  signal  applied  to  terminal  6 of  U8-1  and  terminal  5 of 
U6-2.  Here,  reset  (a  ZERO)  is  applied  as  long  as  both  A1  and  A2  are  not 
activated  during  the  no-test  interval.  This  condition  is  logically  ex- 
pressed as  TC12  TC22  A1  A2,  where  the  overall  conversion  denotes  that  the 
reset  condition  is  represented  by  a logical  ZERO. 

Under  cable  short  conditions  reset  is  removed.  Then  at  the  termina- 
tion of  TC22  and  the  beginning  of  no-test  (TC12  TC22)  Al,  which  is  re- 
activated before  A2 , is  applied  directly  to  U3-2  where  it  is  combined  with 
the  no-test  term. 

The  no-test  term  is  obtained  by  inverting  the  states  presented  by 
TC 12  and  TC22,  by  way  of  inverters  U10-3  and  U10-4  and  then  ANDing  the 
resulting  signal  with  NAND  gate  U3-1  and  inverter  of  Ul-2  which  generates 
a logical  ONE  for  the  no-test  condition  of  TCl2  TC22  at  the  input  of  U3-2. 
The  output  of  U3-2  is  now  TCl2  TC22  Al,  which  by  way  of  inverter  Ul-4  is 
fed  to  J-K  flip-flop  U8-1 . 

As  with  all  J-K  flip-flops,  input  to  output  operation  is  actuated  by 
a clock  pulse.  In  the  circuit  described,  A2  when  reactivated  after  Al, 
generates  by  way  of  Ul-1,  capacitor  Cl,  NAND  gate  of  U4-2  and  inverter  of 
Ul-4,  a one-shot  pulse  to  terminal  5.  Should  A2  occur  before  Al,  no  in- 
formation would  be  transferred.  In  this  manner,  the  sequence  of  Al  operat- 
ing before  A2  is  detected  and  is  latched  by  U6-1  and  U6-2.  Only  when  cable 
status  returns  to  normal  will  this  information  be  erased. 

The  sensor  cable  open  fault  condition  AT  AT  A3  TC12  TCTT  is  detected 
and  retained  by  the  latch  consisting  of  NAND  gates  U5-3  and  U5-4  during 
test  time  TC12.  By  way  of  inverter  U2-5  its  inverse  is  applied  to  U4. 

After  a careful  study  of  the  possible  sensor  loop  status  modes,  it 
was  concluded  that  the  reset  logic  term  which  most  properly  represents  a 
return  to  normal  condition  would  be  TC12  T CTT  A12.  This  term  signifies 
that  Al  and  A2  are  being  properly  sequenced  into  an  ON  state  during  TC12, 
an  operation  which  could  only  be  performed  by  way  of  a continuous  cable 
in  the  normal  no-fault,  no-alarm  state.  The  actual  term  for  reset  is  im- 
plemented by  a logical  ZERO.  It  is  applied  by  way  of  NAND  gate  U7-2  to 
terminal  13  of  the  latch. 
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When  an  open  cable  exists,  the  break  In  continuity  prevents  signal 
processor  amplifier  channels  A1  and  A2  from  being  activated  during  TCI. 

At  this  time,  reset  term  TC12  TC22  A12  is  removed  from  the  latch  permitting 
open  cable  information  to  be  reused  and  retained. 

In  open  cable  term  TC12  TC22  AT  A?  A3,  test  pulse  TC12  is  ANDed  with 
TC22  by  way  of  h’AND  gate  U5-1  and  inverter  U2-4. 

The  amplifier  states  of  A1  and  A2  are  ANDed  with  a delayed  presenta- 
tion of  A3  by  NAND  gate  U7-1  and  of  inverter  U2-5.  Here  A3  is  delayed  by 
resistor  R4,  capacitor  C5,  and  biased  comparator  U9-1  to  permit  Al  and  A2 
to  stabilize  before  being  examined  during  TC12.  Otherwise,  a false  open 
cable  fault  warning  signal  would  be  generated. 


The  time  states  of  TC12  and  TC22  and  states  of  amplifier  outputs  Al, 
A2,  and  A3  are  now  combined  in  NAND  gate  U5-2.  The  combined  result  is  now 
applied  to  the  SET  terminal  9 of  U5-3  and  U5-4  latch  in  the  form  TCI 2 't'c22 
Al  A2  A3.  If  an  open  cable  exists,  this  term  is  a ZERO  while  a continuous 
cable  will  give  a ONE.  For  an  open  cable,  a logical  ONE  results  from  the 
latch  network  which  by  way  of  inverter  U2-5  is  presented  as  a ZERO  to  the 
general  CFA  NAND  U4-4.  Should  an  open  cable  be  replaced  and  the  computer 
control  unit  be  re-energized,  reset  action  will  change  this  cable  fault 
ZERO  to  a ONE  as  discussed  below. 


In  the  open  cable  reset  term  TC12  T C22  A12,  A12  is  obtained  in  a 
manner  similar  to  that  discussed  previously.  The  circuitry  used  to  detect 
and  retain  A12  consists  of  J-K  flip-flop  U8-2  and  a latch  consisting  of 
NAND  gates  U6-3  and  U6-4.  Here,  a logical  ZERO  reset  signal  is  continu- 
ously applied  during  the  absence  of  TC12.  TC12  is  applied  in  logical  ONE 
form  as  an  enabling  signal  to  both  J-K  flip-flop  and  latch.  Should  cable 
continuity  be  restored,  Al  and  the  following  pulsed  one-shot  form  of  A2 
(A12  generated  during  TC12)  are  detected  by  the  J-K  flip-flop  and  retained 
by  the  latch.  This  action  provides  a signal  at  terminal  9 of  U7-2  in  the 
form  of  TC12  A12  which  is  then  combined  with  no-turn-off  test  term  TC22 . 
The  result  appears  as  a logical  ZERO  reset  pulse  to  terminal  13  of  the 
open  cable  latch  U5-4  in  the  form  TCI 2 ffc'22  A12 . This  action  restores  the 
no  fault  logical  ONE  at  terminal  13  of  U4-4. 

2. 2. 2. 2 Signal  Processor  Fault  (Channel  A,  for  example) 

A collection  and  simplification  of  the  terms  defining  an  electronic 
fault  in  signal  processor  A results  in  the  following  equation: 

EFA  = TcTT  TC22  (Al  A2) 

+ TClT  TC22  (Al  + A2 ) 

+ TC12  TCH  (Al  Az  + rr  A2  + Al  A3  + A21) 

Here  the  terms  shown  present  those  signal  processor  failures  which,  on  a 
one-fault  basis,  make  it  impossible  to  establish  either  a cable  fault  or 
an  overheat  condition  in  sensor  cable-channel  A. 

After  careful  investigation  it  was  found  that  further  simplification 
of  this  equation  was  warranted. 
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The  first  term,  TC12  TC22  Al  A2 , could  indicate  that  A1  had  become 
shorted,  or  that  a cable  overheat  condition  had  occurred  but  that  A2  was 
in  an  OFF-fault  scat-,  or  that  Al  A2  was  the  eari>  stage  of  a cable  short 
fault  occurrence  where  A2  was  soon  to  follow.  The  condition  could  be 
ascertained  with  certainty  during  the  off-test  period  depicted  in  the 
second  expression  TC12  TC22  (Al  + A2) , the  second  condition  could  be  es- 
tabllshed  during  the  on- test  period  shown  in  the  third  expression  TC12 

TC22  (Al  A2  ) , and  the  third  condition  would  be  discovered  by  the 

cable  fault  circuitry  described  previously  in  section  2.2.1.  As  a result, 
the  term  TC12  TC22  Al  A?  was  removed. 


The  third  term,  TC12  TC22  (A1.A2  + A1A2  + A1A3  + A21)  denotes  that  a 
signal  processor  fault  exists  during  the  turn-on  test  period.  Here,  the 
absence  of  A3  with  or  without,  the  absence  of  Al  (aT  vs  aTaT)  would  consti- 
tute a failure  In  open  cable  circuit  detection.  So  A3  would  suffice. 

A21,  during  turn-off  pulse  TC12,  was  also  removed  because  of  an  important 
aspect  in  single  fault  logistics.  Tt  was  found  that  the  condition  of 
cable  A being  near  but  not  in  an  overheat  state  could  cause  only  A2  to  be 
activated  which  during  turn  on  test  pulse  TC12,  would  cause  A21  to  be 
presented.  The  result  would  be  the  false  display  of  an  electronic  fault 
displacing  a pending  valid  overheat  condition. 

The  final  equation  for  signal  processor  electronic  faults  becomes, 
therefore , 


EFA  = TC12  TC22  (Al  + A2) 

+ TC12  T CTZ  (AlAl  + ALA2  + XT) 

where,  TCI 2 TC22  (Al  + A2)  reveals  that  a signal  processor  fault  exists 

if  Al  or  A2  remain  in  a false  ON  state  during  turn-off  test  pulse  TC22. 

In  Figure  16,  the  terms  are  rresented  in  inverted  form  as  TC12  TC22  (Al  + A2) 
and  TC12  TC22  (A1AT  + A1A2  + AT)  to  terminals  9 and  10,  respectively  of 
NAND  gate  U13-3.  Here  normal  no-fault  states  appear  as  ONE's  and  a fault, 
at  either  input,  is  presented  as  a ZERO. 

In  the  first  term,  TC12  TC22  (Al  + A2),  inverter  U10-3  provides 
TC12  to  terminal  3 of  NAND  gate  3—4—  5—6  of  U12.  By  way  ofinverters  U10-1 
and  U10-2  and  dual  input  NAND  gate  1-2-3  of  U12,  the  term  A1A2  is  obtained 
and  applied  to  terminal  4 of  U12.  In  combination  with  12-11-8  of  dual  com- 
parator U17,  and  NOR  gates  2-3-1  and  8-9-10  of  U16,  a slightly  stretched 
form  of  TC22  is  applied  to  terminal  5 of  U12.  As  will  be  explained  later, 
the  stretching  of  TC22  permits  greater  discrimination  between  nonsense 
pulses  generated  during  normal  no-fault  conditions  and  true  fault  pulses, 
The__result  at  terminal  6 of  U12  is  an  output  in  the  form  of  't'(j1I2  (TC22  + t) 
aT  A"2  which  is  rewritten  as  Vc'l! 2 (TC22  + t)  (Al  + A2) . 


To  obtain  the  second  term,  TC12  TC2?  (AlA?  + ATA2  + XT)  , the  term 


A1A2  ATA2  A3 


is  first  developed  by  way  of  inverters  1-2  and  3-4  of  U10,  dual  NAND  gates 
10-9-8  and  12-13-11  of  U3,  NAND  gate  10-9-8  of  U15,  inverter  13-12  of  U10, 
and  dual  NAND  gate  4-5-6  of  U14.  It  Is  then  combined  with  a slightly 
stretched  form  of  TC12  (TC12  + t)  and  TC22  to  become 
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(TCI 2 + t)  TC22  (A1A?  A1A2  AJ)  , 
which  in  effect  is 

(TCI 2 + t)  TC7T  (AlST  + aTa2  + AT), 

the  fault  term  in  ZERO  form.  This  term  is  applied  to  terminal  10  of  U13. 

For  false-ON  or  false-OFF  signal  processor  faults,  the  ZERO  pulse 
applied  to  terminals  9 or  10,  respectively,  of  U13  causes  on  output  fault 
pulse  EFA  in  logical  ONE  form,  to  be  applied  to  a delay  network.  The 
delay  network  acts  as  a well  defined  low  pass  filter  which  blocks  non- 
sense pulses  of  short  pulse  width  formed  during  the  normal  no-fault  gating 
operations  associated  with  each  of  the  two  terms  described  above,  but 
allows  the  broader  pulses  generated  by  true  signal  processor  fault  con- 
ditions during  TC12  + t and  TC22  + t to  be  detected.  The  delay  network 
consists  of  resistor  R9 , capacitor  C16  and  biased  comparator  11-12-8  of 
U9 . 


Signal  processor  fault  information  is  thus  obtained  in  pulse  form 
at  output  terminal  8 of  U9 . Here  a logical  ONE  pulse  occurs  from  a 
false-OFF  fault  presented  during  TC12  + t or  a false-ON  presented  during 
TC22  + t. 

The  latching  network  which  retains  false-OFF  fault  information  con- 
sists of  NAND  gates  1-2-3  and  4-5-6  of  U15.  Should  a false-OFF  fault 
pulse  (the  second  term  in  the  equation)  occur  during  TC12,  it  and  a key- 
ing pulse  representing  TC12  + t are  then  combined  to  provide  an  actuating 
pulse  at  SET  terminal  1 of  the  latch.  This  results  in  an  inverted  EFA 
signal  in  logical  ZERO  form  being  applied  to  terminal  9-10  of  triple  NAND 
output  gate  U12.  When  proper  operation  of  the  amplifier  channels  has  been 
restored,  a reset  pulse  generated  by  the  combination  of  TC12  + t and  the 
amplifier  outputs  at  NAND  gate  12-13-11  of  U15  is  applied  to  RESET  terminal 
5 of  the  latch.  This  action  changes  the  logical  ZERO  fault  presentation 
at  terminals  9-10  of  U12  to  a ONE. 

In  like  fashion,  the  latching  network  which  retains  false-ON  fault 
information  consists  of  NAND  gates  12-13-11  and  9-10-8  of  U14.  Here,  a 
false-ON  fault  pulse  occurring  during  TC22  is  combined  with  a keying 
pulse  representing  TC22  + t at  NAND  gate  1-2-3  of  U14  to  provide  an 
actuating  pulse  to  SET  terminal  12  of  the  latch. 

The  repair  of  signal  processor  false-ON  faults  will  now  eliminate 
output  fault  pulse  EFA  from  terminal  8 of  U9  and  cause  a logical  ZERO  to 
exist  at  terminal  1 of  U14  during  turn-off  pulse  TC22.  This  condition 
will  allow  a differentiated  TC22  + t pulse  to  reset  the  U14  latch.  (The 
differentiation  is  performed  by  C19  and  R10.)  The  result  is  that  the 
false-ON  fault  ZERO  presentation  at  terminal  11  of  triple  NAND  gate 
9-10-11-8  of  U12  is  replaced  by  a no-fault  logical  ONE. 

In  a manner  similar  to  the  operation  of  the  CFA  output  gate  12-13-11 
of  U4,  a fault  ZERO  at  either  input  terminal  9-10  or  11  of  NAND  gate 
9-10-11-8  of  U12  causes  a logical  ONE  EFA  fault  output  signal  at  terminal 
8 of  U12.  Here,  restoration  of  proper  operation  will  change  the  logical 
ONE  to  a normal  no-fault  ZERO. 
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Sensor  cable  and  signal  processor  faults  for  loop  B are  obtained  in 
Identical  fashion  with  alarm  channel  amplifiers  Bl,  B2  and  B3.  A grouping 
of  the  fault  equations  for  both  sensor  cable-alarm  channel  systems  Is 
presented  below: 

CFA  = A12  TCl!  T C77  + XT  A?  A3  TC12  Tc57 

CFB  =■  Bl 2 TTT7  TF77  + Bl  IT  B3  TC12  TC7? 

EFA  = TCTT  TC22  (A1  + A2) 

+ TCI 2 TcT?  (A1  £7  + AT  A2  + AT) 

EFB  = ICTI  TC22  (Bl  + B2) 

+ TCI 2 Ten  (Bl  n + IT  B2  + IT) 

Here,  the  terms  TCI  2 + t and  TC22  + t have  not  been  shown  because 
they  are  not  used  in  fault  pulse  generation,  but  in  pulse  detection  only. 

2.3  Multiple  Output  Circuitry 

The  multiple  output  board,  board  A for  example,  provides  in  the 
main,  overheat  detection  and  signal  presentation  (OHA)  for  its  associated 
sensor  cable-signal  processor  channel,  a bidirectional  solid  state  inter- 
lock between  OHA  and  correspondingly,  cable  fault  signal  CFA  and  signal 
processor  fault  signal  EFA,  a simple  electronic  fault  term  COHFA,  and 
stretched  pulses  TC12  and  TC22  which  are  expansions  of  clock  pulses  TCI 
and  TC2,  respectively.  Refer  to  Figure  17. 

One  generated  through  first-come  first-serve  logic,  OHA  is  applied 
to  the  Crew  Read-out  Unit  for  storage  to  be  combined  with  other  signals, 
should  they  occur.  Signals  CFA  and  EFA  are  by  way  of  first-come  first- 
serve  logic,  applied  to  the  signal  correlator  board  to  be  combined  with 
those  fail  terms,  which  heretofore,  have  not  been  considered  (fail  terms 
for  the  clock  and  power  supplies)  to  derive  OHFA.  The  CFA  signal  is  also 
applied  to  the  Maintenance  Warning  Unit  for  presentation  of  a cable  fault. 

2.3.1  Overheat  Detection  (Channel  A for  example) 

A study  of  the  truth  table  shown  in  Appendix  IV  results  in  the 
following  equation  of  overheat  signal  OHA: 

OHA  = TcT?  TcTT  A21 

Here,  A21  indicates  the  sequence  of  actuation  of  processor  amplifier  A2 
before  A1  which  occurs  when  a non-instantaneous  overheat  condition  is 
sensed  by  Cable  A during  the  no-test  period. 


2.3. 1.1  Overheat  and  Reset  Logic 


An  overheat  condition,  A2  before  Al,  is  detected  by  J-K  flip-flop 
14-1-13,  of  U3,  and  retained  by  a latch  circuit  consisting  of  NAND  gates 
4-5-6  and  10-9-8  of  U4.  Both  flip-flop  and  latch  circuit  are  maintained 
in  a normally  reset  state  by  the  condition  represented  by  the  equation: 


RESET 
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Here  the  overall  inversion  signifies  that  the  reset  signal  is  a 
logical  ZERO  which  exists  when  A1  and  A2  are  normal  (each  zero)  during 
the  no-test  period.  TCI 2 + t and  TC2  2 + t are  used  to  ensure  that  A1 
and  A2  have  been  attained  in  the  region  beyond  test. 

The  reset  term  is  obtained  with  4 input  NAND  gate  1-2-4-5  of  Ul. 
Here,  TC12  + t , TC22  + t,  AT  and  A?  (by  way  of  inverter  3-4  of  U12)  are 
normally  applied  as  logical  ONE’s  to  input  terminals  1,2,4  and  5 respec- 
tively of  NAND  gate  Ul.  This  results  in  the  reset  function  described 
above  being  provided  at  output  terminal  6 of  Ul.  By  way  of  the  delay 
network  consisting  of  resistor  Rll,  capacitor  C12,  and  biased  comparator 
11-12-8  of  U5,  and  inverter  13-12  of  Ull,  reset  is  also  transmitted  to 
output  terminal  43  where  it  is  applied  to  the  Crew  Readout  Unit  as  OHA 
RESET. 


To  present  the  no-test  interval,  TC12  and  TC22  are  NANDed  at  input 
terminals  9 and  10,  respectively  of  NAND  gate  Ul. 

When  activated  by  an  overheat  condition,  A2  appears  first  and  is 
applied  to  J terminal  14  cf  J-K  flip-flop  U3.  In  addition,  reset  is  re- 
moved. Al,  in  following  A2,  provides,  by  way  of  input  terminal  12  of 
Ul  and  the  circuit  consisting  of  inverter  3-4  of  U2,  capacitor  C4,  and 
input  terminal  13  of  input  NAND  gate  Ul,  a signal  which  when  combined  with 
TC12  and  TC22  at  terminals  9 and  10  respectively,  generates  a one-shot 
pulse  representing  TCl2  T C22  Al. 

This  pulse,  when  applied  to  clock  terminal  1 of  U3  permits  A2  in- 
formation existing  at  J terminal  4 to  be  transmitted  in  inverted  form  to 
inverted  output  terminal  13.  The  resulting  logic  is  TcW  ft 2 2 A21  where 
the  overall  inversion  symbol  denotes  that  an  overheat  condition  is  detected 
and  presented  as  a logical  ZERO.  This  signal  is  applied  to  latch  SET  ter- 
minal 4 of  U4.  Latch  output  at  terminal  6 of  U4  is  now  TCI 2 TC77  A21 
(actually  OHA)  which  by  way  of  the  low  pass  filter  consisting  of  resistor 
R4,  capacitor  C6,  and  biased  comparator  U5,  is  applied  as  a logical  ONE  to 
NAND  gate  3-4-5-6  of  U7.  This  NAND  gate  forms  part  of  the  solid  state 
interlock  circuitry  between  OHA  and  CFA  or  EFA.  If,  at  this  time,  there 
is  no  cable  fault  or  signal  processor  electronic  fault,  CFA  and  EFA  appear 
as  logical  ONE’s  at  terminals  4 and  5,  respectively,  of  NAND  gate  3-4-5-6 
of  U7,  thereby  permitting  OHA  input  at  terminal  3 to  generate  a logical 
ZERO  at  output  terminal  6 of  U7. 

This  ZERO  output,  after  being  inverted,  appears  as  a logical  ONE 
(OHA  FIRST)  at  output  terminal  35.  In  addition,  this  ZERO  output  is  also 
applied  to  terminals  1 and  11  of  NAND  gate  1-2-13-12  and  9-10-11-8  of  U7. 
This  action  forces  CFA  and  EFA  to  stay  at  locigal  ONE  levels,  thereby  re- 
taining OHA  at  NAND  gate  3-4-5-6  of  U7  and  also  preventing  the  presenta- 
tion of  a CFA  or  EFA  output. 

When  an  overheat  condition  has  passed  and  sensor  cable  A is  once 
again  at  a normal  no-alarm  resistance  level,  A2  and  Al  become  deactivated. 
In  turn,  logical  ONE  signals  again  appear  at  terminals  1,  2,  4 and  5 of 
NAND  gate  Ul;  the  reset  term  "(TcTF+t)  (^C  2 ^ + "t)  Tf  AZ  is  again  gener- 
ated, .J-K  flip-flop  14-1-13  of  U3  and  the  overheat  latch  discussed  above, 
are  reset  and  an  OHA  RESET  signal  in  logical  ONE  form  again  appears  at 
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terminal  43  for  reset  operation  of  the  OHA  alarm  circuitry  located  in  the 
Crew  Readout  Unit. 

The  overheat  pulse  from  terminal  8 of  U1  will  be  lost  if  A1  becomes 
ONE  during  test  time,  when  TC12  or  TC22  are  ONE.  Then  no  OVERHEAT  indica- 
tion will  be  given.  Since  TC12  and  TC22  occupy  about  80  milliseconds  of 
the  14.4  second  test  cycle,  one  would  expect  this  condition  to  occur  about 
.080/14.4  = .0055%  of  the  time.  This  would  mean  that  about  one  out  of 
every  180  overheat  conditions  (resulting  from  one  cable)  would  not  give  an 
OVERHEAT  indication.  Experiments,  however,  show  that  only  about  one  out 
of  every  2900  overheat  conditions  is  missed.  The  reason  for  this  dis- 
crepancy is  unknown. 

2.3.2  CFA  and  EFA  Logic  and  Interlock. 

Since  cable  fault  (CFA)  and  signal  processor  fault  (EFA)  information 
is  derived  from  the  same  set  of  signal  processor  amplifier  channels  Al, 

A2  and  A3,  the  occurrence  of  both  events,  if  not  differentiated,  could 
lead  to  unintelligible  information  (two  lines  in  the  truth  table  at  one 
time).  For  this  reason,  CFA  and  EFA  are  retained  on  a first-come  first- 
serve  priority  basis  by  way  of  interlock  circuitry.  This  circuitry  con- 
sists of  NAND  gates  1-2-13-12  and  9-10-11-8  of  U7. 

By  way  of  the  delay  network  consisting  of  resistor  R17,  capacitor 
C19,  and  biased  comparator  3-4-15  of  U6,  a CFA  signal,  generated  by  the 
circuitry  described  in  Section  2.2  is  applied  as  a logical  ONE  to  input 
terminal  2 of  U7.  In  analogous  fashion,  an  EFA  signal,  obtained  by  way 
of  the  delay  network  consisting  of  resistor  R24,  capacitor  C22,  and  biased 
comparator  11-12-8  is  applied  as  a logical  ONE  to  input  terminal  10  of 
U7. 

I t should  be  observed  that  the  normal  no-fault  no-alarm  state  of 
CFA , eFa,  and  OHA  are  applied  as  logical  ONE's  to  their  corresponding 
interlock  opposites.  That  is,  CFA  and  EFA  are  applied  to  terminals  4 and 
5,  respectively,  of  OHA  gate  3-4-5  of  U7,  CFA  is  applied  to  terminal  9 of 
EFA  gate  9-10-11-8  of  U7,  EFA  is  applied  to  terminal  13  of  CFA  gate  1-2-13 
of  U7,  and  OHA  is  applied  to  both  CFA  and  EFA  gates  as  desc-lbed  previous- 
ly. Thus  an  alarm  state  for  any  one  of  these  variables  will  'esult  in 
its  inverted  form  locking  out  the  other  two. 

2.3.3  COHF  Circuitry  and  Logic  (Channel  A.  for  example) 

As  discussed  previously,  signal  processor  faults  which  cause  a loss 
in  detection  of  either  cable  faults  or  overheat  conditions  are  designated 
as  EF  (EFA  for  loop  A,  for  example).  Even  though  faults  of  lesser  sever- 
ity would  not  necessarily  affect  normal  operation,  they  would  constitute 
an  impending  danger  in  being  the  cause  of  future  faults  of  greater  sever- 
ity. The  term  for  these  faults,  in  signal  processor  A,  for  example,  is 
COHF A . 


An  examination  of  the  faults  in  the  truth  table  lead  to  a selection 
of  this  equation  for  COHFA: 

COHFA  = TClI  TC22  A3 
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This  term  is  obtained  by  use  of  NAND  gate  3-4-S-6  of  U8  and  retained 
by  a latch  consisting  of  NAND  gates  1-2-13-12  and  9-10  11-8  of  U8.  Here  * 

states  TcT?,  TC22  and  A3  are  applied  to  terminals  3,  4 and  5 respectively. 

If  during  Til2  TC22,  A3  is  in  a false-ON  state,  all  inputs  then  appear  as 
logical  ONE's.  This  condition  results  In  a logical  ZERO  output  at  terminal 
6 of  U8  which,  when  applied  to  terminal  1-2,  sets  the  latch.  The  result- 
ing output  of  the  latch,  at  terminal  12  of  U8  is,  by  way  of  inverters  11-10 
of  U2  and  9-8  of  Ull,  presented  as  a logical  ONE  COHFA  signal  at  output 

terminal  49  for  transmission  to  the  following  signal  correlator  circuit.  ( 

I 

After  repair,  A3  then  appears  as  a logical  ZERO  during  TC12  TC22  and 
resets  the  latch  described  above,  causing  the  COHfA  signal  at  output  ter- 
minal 49  to  be  restored  to  a normal  no-fault  ZERO  ; 

2.3.4  TCI 2 and  TC22  Circuitry 

As  stated  previously,  test  pulses  TCI  and  TC2  are  generated  by  clock 
circuitry.  Their  pulse  widths,  normally  25  and  15  milliseconds,  respec- 
tively, are  quite  adequate  for  implementing  the  diagnostics  of  U/V  fire  and 
fire  fault  detection,  but  because  of  the  timing  relations  between  overheat 

amplifier  channels  A1  and  A2,  are  too  small  for  overheat  and  overheat  j 

fault  detection.  , 

TC12,  nominally  45  milliseconds,  is  obtained  by  applying  TCI  to  a 
pulse  stretching  network  consisting  of  one-shot  multivibrator  4-6  of  U9 
located  on  the  A board.  The  resulting  output  is  by  way  of  inverters  13-12 
of  U2  and  11-10  of  Ull  applied  to  output  terminals  41  and  47  for  use  at  all 
overheat  signal  processor  circuits  and  fault  circuits  (A  and  B) . In  like 
fashion  TC22,  nominally  35  milliseconds,  is  obtained  by  way  of  one-shot 
multivibrator  12-10  of  U9  and  applied  by  way  of  NAND  gate  1-2-3  of  U4  and 
inverter  1-2  of  U12  to  output  terminals  19  and  21. 

On  occasion,  when  power  is  first  applied  to  the  CCU,  a false  TC22 
pulse  is  generated  by  U9,  at  the  same  time  that  TC12  is  generated.  This 
false  pulse  is  believed  to  be  caused  by  turn-on  transients,  and  can  seri- 
ously disrupt  the  system  operation.  For  this  reason,  a connection  is 
made  from  U2-12  to  U4-4  to  gate  out  this  undesired  pulse. 

2.4  Signal  Correlator  Circuitry  and  Logic  j 

Signal  correlator  circuitry  combines  the  secular  warning  terms  of 
fire  sensor  failure,  fire  signal  processor  failure,  overheat  sensor  failure 
(A  or  B) , overheat  signal  processor  failure  (A  or  B) , clock  failure,  and 
voltage  failure,  to  provide  the  final  signals  for  overheat  fail  (OHFA  and 
OHFB),  fire  fail  (FFW) , and  computer  failure  (C).  This  circuitry,  which 
is  powered  by  the  +5V  reference  supply,  is  shown  in  Figure  18. 

2.4.1  C Correlator  Circuitry 

The  term  C represents  any  electronic  failure,  simple  or  serious,  in 
U/V  fire  signal  processor  circuitry,  overheat  signal  processor  circuitry, 
in  clock  circuitry,  or  in  power  supply  circuitry.  The  equation  representing 
this  correlation  is: 

I 
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Figure  18.  Logic  Diagram 
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EFA  + EFB  + COHFA  + COHFB 

+ CUV  (11-31  and  12-32)  + CUV  (41-61  and  42-62) 
+ Clock  Monitor  + -5.80O.3OOV  Monitor  + 5V  M''"* 


The  right  side  of  the  above  expression  are  inputs  which  are  applied 
to  the  signal  correlator.  By  way  of  inverter  1-2,  3-4,  5-6,  9-8  of  Ul, 
dual  NAND  gates  1-2-3  and  4-5-6  of  U3,  NAND  gate  U5  and  NOR  gate  9-8-10 
of  U4,  all  of  the  terms  are  ORed.  The  resulting  output  is  then  inverted 
by  inverter  1-2  of  U2  and  presented  at  output  terminal  C for  transmission 
to  the  Maintenance  Warning  Unit.  For  normal  no-fault  conditions  C is  a 
logical  ZERO.  When,  however,  any  input  presents  an  electronic  fault 
alarm,  C is  transferred  to  a logical  ONE  state. 


2.4.2  OHFA  and  OHFB  Correlator  Circuitry 

To  be  complete,  overheat  failure  statements  must  also  include  the 
failures  in  clock  circuitry  and  power  supply  circuitry.  The  equations  for 
OHFA  and  OHFB  now  become: 


OHFA  = CFA  + EFA 

+ Clock  Monitor  + -5, *800, 300V  Monitor  + 5V  Monitor 
OHFB  = CFB  + EFB 

+ Clock  Monitor  + -5*7800, 300V  Monito'r  + 5V  Monitor 

Here,  the  terms  for  OHFA,  for  example,  are  ORed  by  way  of  NAND 
gates  1-2-3  and  4-5-6  of  U3,  NOR  gate  2-3-1  of  U4,  inverter  11-10  of  U7, 
and  NAND  gate  1-2-13-12  of  U6.  The  resulting  output  from  terminal  12  of 
U6  is,  by  way  of  inverters  1-2  of  U7  and  3-4  of  U2,  presented  at  output 
terminal  41  for  transmission  to  the  Crew  Readout  Unit. 

In  like  fashion,  the  terms  for  OHFB  are  ORed  by  way  of  NAND  gates 
1-2-3  and  4-5-6  of  U3,  NOR  gate  6-5-4  of  U4,  inverter  13-12  of  U7,  and 
NAND  gate  3—  4—  5—6  of  U6.  The  resulting  output  from  terminal  6 of  U6  is 
by  way  of  inverters  3-4  of  U7  and  5-6  of  U2  presented  at  output  terminal 
45. 


For  normal  no-fault  conditions  OHFA  and  OHFB  are  logical  ZERO's. 
Should  a cable  or  signal  processor  fault  appear  at  the  input,  OHFA  or 
OHFB  (or  both  if  a fault  occurs  in  each  channel)  will  change  from  logical 
ZERO  to  logical  ONE.  When  a clock  or  power  failure  appears,  both  OHFA 
and  OHFB  will  change  from  ZERO  to  ONE.  The  individual  presentation  of 
OHFA  or  OHFB  to  the  Crew  Readout  Unit  will  result  simply  in  their  storage 
for  future  use.  The  presentation  of  both  OHFA  and  OHFB,  however,  will 
result  in  the  display  of  OHEAT  FAIL  in  the  Crew  Readout  Unit. 

2.4.3  FFW  Correlation  Circuitry 

In  a manner  analogous  to  the  final  generation  of  OHFA  and  OHFB, 

FFW  is  obtained  by  combining  the  fire  fail  warning  signal  FFW  with  both 
clock  and  power  failure  warning.  The  equation  showing  this  relation  is: 
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Here  the  terms  for  FFW  are  ORed  by  way  of  NAND  gates  1-2-3  and  4-5-6 
of  U3,  inverter  9-8  of  U7,  and  NAND  gate  9-10-11-8  of  U6.  The  output  at 
terminal  8 of  U6  is  applied  by  way  of  inverter  5-6  of  U7  and  9-8  of  U2  to 
output  terminal  49. 

A presentation  of  a fault  signal  at  any  input  will  cause  the  output, 
FFW,  to  change  from  a normal  no-fault  logical  ZERO  to  a logical  ONE. 


3.  CLOCK  GENERATOR  AND  PULSE  TIMING 

All  of  the  timing  signals  necessary  to  operate  the  fire  detection 
system  and  the  overheat  detection  system  emanate  from  this  circuit  (refer 
to  Figure  19.)  The  circuit  consists  of  a clock  pulse  generator  whose 
output  is  applied  to  four  cascaded  counter  circuits  to  obtain  pulse  edges 
at  certain  intervals  of  time.  These  timed  pulse  edges  are  then  decoded 
and  summed  to  yield  the  test  pulses  employed  in  this  system. 

3.1  The  Clock 

The  clock  pulse  generator  consists  of  an  integrating  circuit  timing 
oscillator  U2.  Resistors  R1  and  R2  and  capacitor  Cl  are  employed  with  U2 
to  generate  the  basic  clock  pulse  at  output  terminal  3 of  U2.  This  pulse 
is  a periodic  square  wave  voltage  whose  width  and  period  of  repetition 
are  nominally  100  microseconds  and  one  millisecond,  respectively. 

3.2  Counting 

By  way  of  inverter  9-8  of  U13,  the  clock  pulse  is  applied  to  a cas- 
caded counter  circuit  consisting,  in  the  main,  of  integrated  circuit 
counters  U4,  U3,  U5  and  U6.  Here,  U3,  U4  and  U6  are  4-BIT  ripple  binary 
counters,  while  U5  is  a decade  counter  wired  to  provide  divide-by-ten 
counting.  By  way  of  NAND  gate  9-10-12-13-8  of  U12  and  NAND  gate  1-2-3  of 
U10,  U4  counts  and  resets  with  every  15  pulses  applied  from  the  clock  so 
as  to  provide  a single  100  microsecond  pulse  about  every  15  milliseconds, 
a divide  by  15  operation. 

The  output  of  U4  is  now  applied  to  U3,  which  in  turn,  provides 
periodic  half-period  square  wave  pulses  every  30,  60,  120  and  240  milli- 
seconds (pulse  widths  of  15,  30,  60  and  120  milliseconds  respectively)  at 
terminals  13,  9,  10,  and  12  respectively.  Here,  the  60  millisecond  pulse 
(with  a period  of  120  milliseconds)  at  terminal  10  represents  a divide-by- 
8 output  which  is  now  applied  to  divide-by-10  counter  U5  to  obtain  600 
millisecond  pulses  every  1200  milliseconds.  This  periodic  voltage  is 
applied  to  input  terminal  14  of  U6. 

Output  terminal  12  of  U6  provides  an  unsymmetrical  square  wave  9.6 
seconds  long,  which  is  repeated  every  14.4  seconds.  Repetition  is  accom- 
plished by  employing  the  coded  outputs  of  terminals  12,  10,  9 and  13  when 
they  render  the  logic  presentation  1,  1,  0,  0 respectively.  (This  is  the 
standard  binary  presentation  for  an  input  count  of  12.)  By  way  of  inverters 
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1-2  and  3-4  of  U18,  NAND  gate  1-2-4-5-6  of  U12,  inverter  5-6  of  U17  and 
NAND  gates  10-9-8  and  12-13-11  of  U10,  this  divide-by-12  output  array 
generates  a reset  pulse  into  terminal  2 of  U6,  and  the  process  is  then 
repeated  14.4  seconds  later  (12  counts  X 1200  milliseconds  per  count). 

The  positive-going  front  edge  of  the  9.6  second  output  pulse  is 
applied  every  14.4  seconds  to  clock  terminals  11  and  3 of  D-type  flip- 
flops  12-9  and  2-5  of  U9 , respectively,  yielding  a logical  ONE  output  at 
Q terminals  9 and  5 and  a logical  ZERO  at  Q terminals  8 and  6 every  14.4 
seconds.  The  flip-flops  provide  a start  time  reference  at  which  some  of 
the  pulses  previously  mentioned  are  keyed  to  generate  the  test  pulses 
employed  in  the  overheat  and  fire  signal  processor  and  logic  circuitry. 

3.3  Fire  Test  Pulses 

3.3. 1 Test  Pulse  TT 

Test  pulse  T1  is  applied  to  both  the  U/V  glow  lamp  switch  and  fire 
warning  logic  circuitry  every  14.4  seconds. 

The  pulse  width  of  TT  is  established  by  first  NANDing  the  binary 
outputs  at  terminals  13,  9 and  10  of  counter  U3  at  NAND  gate  9-10-11-8  of 
Ul.  The  resulting  output  at  terminal  8 of  U1  appears  as  a periodic  ONE 
voltage  pulse  which  is  105  milliseconds  wide  and  is  repeated  every  120 
milliseconds. 

Since  counter  U3  is  linked  by  counters  U5  and  U6  to  the  basic  14.4 
second  timing  period  (about  4 times  a minute),  the  front  edge  of  the  first 
105  millisecond  pulse  will  coincide  with  the  beginning  of  the  14.4  second 
period.  The  two  signals  are  combined  at  D-type  flip-flop  U9  and,  by  way 
of  inverter  3-4  of  U14,  are  presented  as  a ZERO  level  pulse  (ONE  going  to 
ZERO)  which  is  nominally  105  milliseconds  wide  and  repeated  every  14.4 
seconds.  This  pulse,  T1  is  presented  at  circuit  output  terminal  6. 

3.3.2  Test  Pulse  T2 

Test  pulse  T2  is  employed  to  implement  the  testing  of  the  U/V  signal 
processor  operating  in  conjunction  with  Fire  Warning  circuitry.  This  test 
is  applied  to  each  U/V  alarm  channel  (Signal  Processor  and  Fire  Warning). 
The  pulse  is  essentially  a group  of  15  logical  ONE  pulses  grouped  in  a 
15  millisecond  time  envelope.  This  group  is  applied  approximately  105 
milliseconds  after  the  initiation  of  the  system  (14.4  second  period)  reset 
pulse  and  reapplied  every  14.4  seconds. 

T2  is  obtained  by  NANDing  the  one  kilohertz  output  clock  U2  with  a 
15  millisecond  time  envelope  which  is  repeated  every  test  time  (14.4 
seconds).  The  envelope  is  obtained  by  NANDing  the  105  millisecond  ^ out- 
put and  the  120  millisecond  Q output  at  output  terminals  8 and  5,  respec- 
tively, of  D-type  flip-flop  U9  which  is  clocked  every  14.4  seconds. 

3.3.3  Test  Pulse  T 

Test  pulse  T is  used  in  conjunction  with  test  pulse  TT  to  test  Fire 
Fail  warning  logic.  It  is  obtained  from  Q output  terminal  6 of  D-type 
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flip-flop  U-9  and,  by  inverters  11-10  of  1113  and  11-10  of  U14,  applied  to 
output  terminal  7.  Output  T is  normally  at  a ONE  logic  level  but  is  trans- 
ferred to  a ZERO  level  for  120  milliseconds  at  the  beginning  of  every 
system  reset  period  of  14.4  seconds  (about  4 times  a minute). 

3.3.4  Test  Pulse  T* 

Output  T*"  is  used  to  test  Fire  Warning  logic  circuitry.  it  has  a 
normal  logic  ONE  value  which  is  changed  to  ZERO  for  125  milliseconds  at 
the  beginning  of  every  system  reset  time  occurring  every  14.4  seconds 
(about  4 times  a minute). 

The  source  of  T*  is  Q output  terminal  5 and  Q output  terminal  6 of 
D-type  flip-flop  U-9.  Q is  a 120  millisecond  wide  logic  ZERO  pulse  occur- 
ring every  14.4  seconds.  Here,  Q is  applied  by  way  of  inverters  3-4  of 
U13  and  5-6  of  U15,  to  a delay-shift  network  consisting  of  resistor  R5, 
capacitor  C7  and  inverter  1-2  of  U15.  The  output  of  the  shift  network  is 
now  NANDed  with  Q to  generate  a logic  ONE  pulse  at  terminal  8 of  NAND  gate 
U16  which  is  125  milliseconds  wide.  By  way  of  inverter  13-12  of  U15  this 
pulse  is  now  inverted  into  output  signal  T*  and  applied  to  output  terminal 
5. 

3.3.5  Test  Pulse  T1  Reset 

T1  Reset  is  a logical  ONE  double  pulse  which  is  used  to  implement  a 
reset  operation  on  the  retriggerab le  monostable  multivibrators  in  the  U/V 
signal  processor.  The  first  pulse  is  generated  at  the  beginning  of  system 
reset  and  the  second  pulse  occurs  120  milliseconds  later.  This  process 
is  repeated  at  the  beginning  of  each  system  reset  period  of  14.4  seconds 
(about  four  per  minute). 

A periodic  pulse  is  first  generated  by  NANDing  the  inverted  outputs 
at  terminals  9,  10  and  12  of  counter  U4  with  the  inverted  outputs  of  9 
and  10  of  counter  U3.  The  result  at  output  terminal  8 of  NAND  gate  Ull  is 
now  inverted  and  applied  to  input  terminal  12  of  NAND  gate  U16  where  it 
appears  as  a periodic  logical  ONE  pulse  about  100  microseconds  wide  which 
is  repeated  every  120  milliseconds. 

The  other  input  to  terminal  13  of  NAND  gate  U16  receives  the  inverse 
of  T*  (refer  to  3.3.4),  namely  T^,  which  is  a logical  ONE  pulse  125  milli- 
seconds wide  occurring  at  the  beginning  of  each  system  reset  period  of 
14.4  seconds.  The  output  at  terminal  11  of  NAND  gate  U16  is  inverted  by 
inverter  3-4  of  U15  and  appears  as  the  logical  ONE  double  pulse,  T1  Reset. 

3.3.6  Test  Pulse  T Reset 

T Reset  is  a reset  pulse  which  is  applied  to  the  U/V  signal  proces- 
sor every  2.4  seconds.  The  2.4  second  repetition  time  is  obtained  from 
output  terminal  9 of  counter  U6  which  presents  a half-wave  pulse  2.4  sec- 
onds wide  every  4.8  seconds.  This  output  is  applied  to  terminal  Z to 
provide  a positive  logical  ONE  keying  pulse  every  2.4  seconds  to  input 
terminal  1 of  NAND  gate  U8  which  combines  the  keying  pulse  with  T* , a 
logical  ZERO  pulse  125  milliseconds  wide  which  is  generated  every  14.4 
seconds  (refer  to  paragraph  3.3.4).  The  output  of  U8-3  is  now  NANDed  with 


the  Inverse  of  T1  reset,  namely  T1  Reset,  a logical  ZERO  double  pulse 
occurring  every  14.4  seconds  (refer  to  paragraph  3.3.5).  The  resulting 
output,  T Reset,  is  a logical  ONE  pulse  about  100  microseconds  wide  which 
is  repeated  every  2.4  seconds  and  is  synchronized  with  the  14.4  second 
system  test  cycle.  Every  sixth  pulse,  at  test  time,  is  double. 

3.4  Overheat  Test  Pulses  TCI  (Turn-on)  and  TC2  (Turn-Off) 

3.4.1  Test  Pulse  TCI  (Turn-On) 

Output  TCI  is  a normal  logic  ZERO  level  voltage  that  is  transferred 
to  a logical  ONE  level  for  29  milliseconds  every  system  test  time  (4 
times  a minute).  It  is  applied  to  the  overheat  detection  system.  It  is 
obtained  by  combining  T1  (obtained  by  inverting  YT  with  inverter  9-8  of 
U15)  with  the  inverted  forms  of  outputs  9 and  10  of  counter  U3  (by  way 
of  inverters  13-12  of  U18  and  5-6  of  U18)  at  NAND  gate  5-4- 3-6  of  Ul. 

The  result  is  a logic  ZERO  pulse  lasting  about  29  milliseconds  which,  by 
way  of  inverter  5-6  of  U14,  is  formed  into  TCI. 

3.4.2  Test  Pulse  TC2  (Turn-Off) 

Output  TC2  is  a normal  logic  ZERO  voltage  which  is  transferred  to  a 
logic  ONE  state  105  milliseconds  after  the  start  of  each  system  test. 

The  logic  ONE  state  exists  for  about  15  milliseconds.  It  is  applied  to 
the  overheat  detection  system.  It  is  derived  by  NANDing  the  105  milli- 
second Q output  and  120  millisecond  Q output  at  terminals  8 and  5, 
respectively,  of  D-type  flip-flop  U9  at  NAND  gate  12-13-11  of  08.  This 
results  in  a normally  ONE  state  signal  which  is  transferred  to  ZERO  105 
milliseconds  after  the  start  of  each  system  test  (every  14.4  seconds)  and 
restored  to  logic  level  ONE  15  milliseconds  later.  This  output  is  In- 
verted by  inverter  13-12  of  U14  into  output  signal  TC2. 

3.5  Clock  Monitor 

The  clock  monitor  is  a checking  circuit  that  determines  proper  clock 
operation.  It  consists  of  retriggerable  monostable  multivibrator  U19 
which  with  resistor  R7  and  capacitors  C2,  C3  and  C4  has  a time  constant 
of  2.9  seconds.  That  is,  for  a given  input  pulse,  the  multivibrator  out- 
put pulse  lasts  2.9  seconds.  If  input  pulses  are  repeated  within  2.9 
seconds,  the  output  is  maintained  at  a logical  ONE  level.  The  actual 
input  is  a logical  ONE  periodic  voltage  obtained  from  the  output  13  of 
counter  U6.  It  is  600  milliseconds  wide  and  is  repeated  every  12C0  milli- 
seconds. If  this  input  is  interrupted  for  more  than  2.9  seconds,  the 
multivibrator  output  will  go  to  logical  ZERO.  This  signal  is  sent  to  the 
Signal  Correlator  to  generate  FAIL  signals  for  the  Crew  Readout  Unit  and 
the  Maintenance  Warning  Unit. 


4.  POWER  SUPPLIES 
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Computer  Control  Unit  contains  a transient  and  reverse  voltage 
power  supply  system  which  operates  on  28  DC  V aircraft  power 
Figure  11).  This  system  consists  of  two  main  switching  regu- 
DC  to  AC  inverter,  and  two  linear  regulators.  One  switching 
supplies,  by  way  of  a load  filter,  8.5  DC  V power  to  the  DC  to 
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AC  inverter.  The  other  switching  regulator  provides  an  800  AC  V square 
wave  for  ultraviolet  sensor  tube  circuitry,  and  by  way  of  simple  rectifier 
circuitry,  300  DC  V for  ultraviolet  test  lamp  circuitry  and  negative  vol- 
tage for  one  linear  regulator  which  supplies  -5  DC  V to  logic  circuitry. 

The  other  linear  regulator,  in  conjunction  with  a storage  capacitor,  is 
used  as  a reference  supply  providing  prolonged  storage  type  +5  DC  V to 
both  signal  correlator  circuitry  and  voltage  monitoring  circuitry. 

4.1  Transient  and  Reverse  Voltage  Protection 

Reverse  voltage  protection  is  accomplished  by  way  of  a fast  recovery 
power  rectifier  connected  in  series  with  the  28  DC  V input  power  line. 

As  shown  in  Figure  20,  DC  power  is  applied  by  way  of  the  rectifier 
to  the  transient  suppression  network  which  consists  of  an  inductor-resistor 
circuit  connected  in  series  with  the  power  supply  system  and  a voltage- 
clamping zener  diode  network  connected  across  the.  power  supply  system. 

Here,  the  inductor  is  used  to  block  high-voltage,  high-frequency  (micro- 
seconds to  milliseconds)  transients  and  to  provide  sufficient  time  for  the 
zener  diodes  to  become  effective.  The  resistor  is  used  to  provide  current- 
limiting  protection  to  the  zener  diodes  for  relatively  long-term  transients. 

4.2  Switching  Regulator 

Switching  regulators  provide  at  least  three  major  advantages  over 
linear  regulators.  These  are:  (1)  higher  efficiency,  seventy-five  to 

eighty-five  percent  being  typical;  (2)  the  use  of  fewer  components  and  (3) 
smaller  size  for  a given  output  power.  The  switching  regulators  used  in 
the  IFOS  are  of  the  self-oscillating  type. 

The  basic  circuit  is  shown  in  Figure  21.  Here,  the  comparator- 
driver  senses  the  voltage  across  the  inductor,  this  voltage  being  related 
to  the  current  i^  by  the  equation: 


Initially,  the  load  voltage  Vo  will  be  zero,  and  Q1  will  be  ON.  The  vol- 
tage at  the  noninverting  input  will  approach  this  value: 


V1  " vin  R a + Rb 


When  Vo  reaches  V,,  the  comparator  will  switch,  turning  Q1  off.  The  diode, 
CR1,  now  becomes  forward  biased  and  will  supply  a path  for  the  inductor 
current.  This  current  and  the  sense  voltage  will  start  to  decrease  until 
Vo  reaches  this  value: 


The  comparator  will  switch,  Q1  will  be  turned  back  on,  and  the  cycle  will 
repeat . 
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Vo,  the  output  voltage,  will  necessarily  contain  a ripple  voltage. 
By  properly  selecting  the  values  of  Ra  and  Rb , the  ripple  voltage  magni- 
tude can  be  kept  small.  The  d.c.  component  of  the  output  voltage  will 
then  be  approximately  Vre£. 

The  switching  frequency  depends  on  component  values,  the  input 
voltage  Vin,  and  the  average  load  current  II-  By  making  this  frequency 
high,  inductor  size  can  be  minimized,  but  then  the  selection  of  a suit- 
able pass-transistor  and  diode  becomes  more  critical. 


Figure  22  shows  the  schematic  of  the  switching  regulator  circuits 
used  in  the  IFOS.  The  MC1569R  integrated  circuit  performs  the  comparator 
function.  The  two  2N1711  transistors  are  used  to  provide  current-limiting. 
Potentiometers  R17  and  R20  are  used  to  adjust  the  two  output  voltages  to 
the  exact  values  required.  Diodes  CR2,  CR3,  CR4  and  CR5  are  used  to  pre- 
vent the  comparator  from  being  driven  into  saturation,  which  would  cause 
a decrease  in  efficiency. 


4. 3 DC  to  AC  Converter 


Operational  theory  common  to  most  transistor  inverters  is  illus- 
trated by  considering  the  basic  push-pull  saturable-transformer  - 
coupled  two-transistor  oscillator  circuit  of  Figure  23. 

Here,  transformer  flux  oscillates  between  the  two  states  of  flux 
density  saturation,  M and  K,  shown  in  Figure  24.  The  frequency  of 
oscillation  can  be  described  by  the  following  equation: 

f = V x 108/4N1AB 

where  f is  the  operating  frequency  in  hertz,  V is  the  peak  voltage  across 
the  primary  winding  of  N1  turns,  A is  the  cross-sectional  area  of  the 
core  in  square  centimeters,  and  B is  the  saturation  flux  density  in  gauss. 
Here,  transformer  flux  is  equal  to  the  product  of  flux  density  and  core 
area  = BA) . 

Resistors  RBI  and  RB2  are  employed  to  equalize  the  base  drive  of 
NPN  switching  transistors  Q1  and  02,  respectively.  Resistor  Rg  assures 
start-up  current  to  transistor  Q1  to  ensure  the  start  of  proper  oscilla- 
tion. 


When  voltage  Vcc  is  applied  and  Q1  is  turned  on,  the  entire  voltage 
less  transistor  saturation  voltage,  is  applied  across  upper  primary  wind- 
ing N'l  (V  = VCC  -VceSAT) . Current  (magnetizing  and  load)  starts  to  flow 
into  the  no-dot  end  of  upper  winding  Nl,  and  flux  and  flux  density  change 
as  a function  of  time  (from  saturation  level  M through  J toward  saturation 
level  K)  at  a constant  rate  to  satisfy  the  equation: 


This  action  causes  voltages  to  be  induced  which  are  positive  at  the  no-dot 
ends  of  the  windings,  providing,  thereby,  a sustaining  base  drive  to  tran- 
sistor Ql,  an  "off"  base  voltage  to  transistor  Q2,  and  a constant  output 
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voltage  which  is  positive  at  the  no-dot  end  of  output  winding  N2 . All 
voltages  are  induced  according  to  the  equation: 

e “ N Zt’  x 

where  e is  the  voltage  induced  in  the  winding  N under  consideration,  and 
dji/dt  is  the  rate  of  change  of  flux  linked  with  winding  N. 

This  condition  continues  until  flux  reaches  the  saturation  level 
denoted  by  K on  Figure  24.  Then,  D<$/dt  and  hence  the  base  voltages,  de- 
crease rapidly.  This  causes  transistor  Q1  to  turn  off,  and,  by  circuit 
interruption  of  upper  winding  N1 , an  inductive  kickback  which  reverses 
the  polarity  on  all  windings  causing  transistor  Q2  to  turn  on.  (The  time 
for  this  reversal  is  determined  by  transistor  response.)  As  Q2  starts 
conducting  current  into  the  dot-end  of  lower  winding  Nl,  transformer  flux 
reverses  direction,  and  flux  density  comes  out  of  saturation  level  K, 
traveling  through  L toward  opposite  saturation  level  M.  This  action  sus- 
tains the  new  voltage  polarities  keeping  Q2  on  and  maintaining  Q1  off. 

The  resulting  induction  now  provides  a constant  output  voltage  which  is 
negative  at  the  no-dot  end  of  output  winding  N2.  This  constant  voltage 
is  induced  until  saturation  level  M is  reached  where  Q2  is  turned  off  and, 
again  by  inductive  kickback,  Q1  is  turned  on.  As  these  processes  are  re- 
peated during  succeeding  half-cycles,  a square  wave  AC  output  voltage  is 
produced . 

The  converter  circuit  used  in  the  IFOS  is  shown  in  Figure  25.  It 
is  identical  to  the  circuit  just  described,  except  that  Rg  is  made  vari- 
able. This  resistor  is  carefully  adjusted  for  each  individual  circuit 
board  to  insure  oscillator  starting  under  all  conditions  of  load  and  tem- 
perature . 

Oscillation  frequency  is  about  1400  Hz,  the  exact  value  being  a 
function  of  supply  voltage  and  the  nature  of  the  load. 

It  was  found  that  if  the  converter  circuit  were  powered  directly 
from  the  switching  regulator,  an  undesirable  interaction  would  occur  be- 
tween the  two  circuits,  both  of  which  are  oscillators.  This  problem  was 
overcome  by  the  use  of  an  isolation  network  labeled  "load  filter"  on 
Figure  20. 

4.4  High-Voltage  Power  Supplies 

An  eight-hundred-volt  square  wave  is  needed  to  bias  the  U/V  sensor 
tubes.  This  is  obtained  by  a high-voltage  winding  on  the  converter 
transformer.  Two  capacitors,  C6  and  C9  are  placed  across  this  winding  to 
eliminate  switching  transients. 

The  purpose  of  the  diode  CR1  and  the  resistors  R7,  R8,  R9 , Rll,  R12 
and  R14  is  to  provide  a low  d.c.  voltage  proportional  to  the  high  a.c. 
voltage.  This  low  voltage  is  called  "Attenuated  800V"  and  is  used  for 
monitoring  purposes  — see  reference  (5).  During  initial  equipment  adjust- 
ment, the  high  voltage  is  set  to  exactly  800V  by  means  of  the  adjustment 
on  the  switching  regulator.  Then,  "Attenuated  800V"  is  set  to  exactly 
1.000V  by  means  of  R12. 
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A three-hundred  volt  direct  current  supply  is  needed  to  operate  the 
test  sources  in  the  U/V  detector  heads.  This  is  obtained  by  use  of  a 
second  high-voltage  winding  on  the  converter  transformer,  a rectifier 
diode  (CR2) , and  a filter  capacitor  (C 8 ) . 

4.5  Negative  Voltage  Power  Supply 

A negative  five  volts  is  required  for  operation  of  the  CCU  circuitry. 
This  power  supply  is  physically  located  on  the  Converter-Inverter  board 
and  the  schematic  appears  in  Figure  25. 

A ten-volt  square  wave  is  taken  from  a winding  on  the  converter 
transformer.  This  is  changed  to  d.c.  by  diode  bridge  CR3,  and  filtered 
by  C5.  The  potential  difference  is  then  reduced  to  five  volts  by  an 
integrated-circuit  linear  voltage  regulator,  Q2.  The  output  voltage  is 
set  by  resistors  R3  and  R4,  and  is  typically  -5.3V.  Resistors  R5  and  R13 
limit  the  output  current  to  about  140mA.  Further  details  of  operation 
can  be  found  in  reference  (5). 

4.6  Reference  Supply 

In  order  to  detect  and  register  certain  types  of  system  defects, 
and  to  simplify  the  "reset"  circuitry  described  in  reference  (6),  it  is 
desirable  to  have  available  an  auxiliary  five-volt  supply.  This  "refer- 
ence supply"  should  come  on  before  the  regular  five-volt  supply  when  the 
main  power  is  supplied,  and  should  maintain  an  output  voltage  longer  than 
the  regular  supply  when  power  is  turned  off. 

A linear  series-type  regulator,  operated  from  the  main  +28  DCV 
(after  the  transient-suppressor),  meets  the  above  requirements.  Phys- 
ically, this  circuit  is  located  on  the  A10  printed-circuit  board,  with 
the  pass-transistor  mounted  on  the  CCU  sidewall,  and  the  output  storage 
capacitor  mounted  outside  of  the  card  rack.  Most  of  the  circuitry  is 
shown  in  Figure  26,  while  the  complete  circuit  is  shown  in  Figure  27. 

In  this  circuit,  the  integrated  circuit  MC1569R  supplies  a voltage 
reference  and  an  error  amplifier.  The  2N6057  transistor  is  of  course  the 
series  control  transistor,  while  the  2N1711  transistor  and  the  20  ohm 
resistor  are  part  of  the  current-limiting  circuit.  The  output  voltage  is 
determined  by  the  1.91  Kohm  and  6.81  Kohm  resistors  together  with  the  2 
Rohm  potentiometer  which  is  used  for  exact  adjustment.  It  is  the  purpose 
of  the  2700  ufd  capacitor  to  maintain  the  output  voltage  for  a number  of 
milliseconds  after  power  is  turned  off.  Further  details  can  be  found  in 
reference  (6). 

5.  VOLTAGE  MONITORS 

Voltage  monitors  are  employed  in  the  Computer  Control  Unit  to  de- 
tect failures  in  power  supply  circuitry  and  excessive  drift  in  supply 
voltages.  These  malfunctions,  in  effect,  constitute  a major  electronic 
fault  because  they  can  cause  improper  circuit  behavior  leading  to  failures 
in  fire  and  overheat  detection. 
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All  voltage  monitoring  is  done  by  way  of  bridge  detection  networks 
(refer  to  Figure  26).  Here,  signals  obtained  by  sampling  the  supply  volt- 
ages under  consideration  are  applied  to  biased  integrated  circuit  compara- 
tors which  perform  the  function  of  voltage-level  detection.  A loss  or  a 
prohibitive  change  in  a particular  supply  voltage  beyond  a predetermined 
level  causes  the  corresponding  comparator  to  provide  a fail  signal  to  the 
signal  correlator  which  then  generates  fail  signals  for  use  in  the  Crew 
Readout  Unit  and/or  the  Maintenance  Warning  Unit. 

5.1  800  ACV , 300  DCV,  and  -5  DCV  Voltage  Monitoring 

Comparator  outputs  for  800  ACV,  300  DCV  and  -5  DCV  voltage  monitor- 
ing are  "wire  ORed"  to  pull-up  resistor  Rl.  Here,  the  signals  for  normal 
no-fault  conditions,  and  a power  supply  failure,  are  presented  as  logical 
ONE  and  a logical  ZERO,  respectively. 

5.1.1  800  ACV  Monitor 

By  way  of  a rectifier  and  voltage  divider  sampling  network  located 
near  the  DC  to  AC  inverter,  and  Cl,  a filtered  DC  analog  signal  of  the  800 
ACV  supply  is  applied  to  a dual-level  detection  network.  This  network 
consists  of  set-point  resistors  R2,  R4  and  R42,  and  comparator  12-11-8  of 
U1  for  high-voltage- level  detection,  and  resistors  R3,  R5  and  R41  and  com- 
parator 3-4-15  of  U1  for  low-voltage- level  detection.  Here,  the  high  and 
low  AC  voltage  boundary  levels  are  set  at  850  ACV  and  750  ACV,  respectively. 

When  a fire  condition  occurs,  transistor  Q4  is  turned  on  to  lower 
the  low  AC  voltage  boundary  to  about  630  volts.  Thus  loading  effects  on 
the  AC  supply  by  the  U/V  sensor  tubes  will  not  disrupt  operation. 

5.1.2  300  DCV  Monitor 

By  way  of  a resistive  voltage-divider  network  connected  to  the  300 
VDC  output,  an  analog  signal  of  the  300  VDC  supply  is  applied  to  terminal 
3 of  comparator  U2.  Here,  the  level  below  which  the  300  VCD  supply  must 
not  drop  is  247  volts  which  is  established  by  set  point  resistors  R8  and 
Rll . 

5.1.3  -5  DCV  Monitor 

The  -5  DCV  supply  voltage  and  the  +5  DCV  reference  supply  voltage 
are  summed  by  way  of  resistors  R9  and  R6 , respectively,  at  inverting 
terminal  12  of  comparator  U2.  If  the  magnitude  of  the  -5  DCV  supply  volt- 
age decreases  beyond  a certain  level  (becomes  less  negative,  increasing 
toward  zero)  the  net  voltage  summed  at  terminal  11  (established  by  R7  and 
R10),  and  comparator  11-12-8  of  U2  then  generates  ZERO  fault  signal  at 
terminal  8. 

5.2  Line  Voltage  and  +5  DCV  Monitoring 

The  loss  or  interruption  of  line  voltage  and/or  +5  DCV  power  to  all 
logic  circuitry  could,  during  transition  time,  be  the  source  of  spurious 
signals  which,  in  reaching  the  Crew  Readout  Unit  and  Maintenance  Warning 
Unit,  could  give  rise  to  false  warnings.  Comparators  3-4-15  and  11-12-8 
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of  U3  are  the  monitors  for  the  +5  DCV  supply  and  line  voltage,  respectively, 
and  are  powered  by  the  +5  DCV  reference  supply  discussed  in  Section  A. 6. 

5.2.1  +5  VDC  Monitor 


By  way  of  voltage  divider  resistors  R16  and  R20,  a signal  voltage 
analog  of  the  +5  DCV  supply  voltage  is  compared  to  the  set  voltage  estab- 
lished by  resistors  R18  and  R22  and  applied  to  terminal  3 of  U3.  When 
the  +5  DCV  supply  voltage  fails,  comparator  3-4-15  of  U3  provides  a ZERO 
signal  to  inverter  13-12  of  U5.  In  turn,  this  inverter  then  provides  a 
logical  ONE  fault  signal  to  the  signal  correlator  which  then  sends  fail 
signals  to  the  Crew  Readout  Unit  and  Maintenance  Warning  Unit. 

5.2.2  Line  Voltage  Monitor 

A signal-voltage  analog  of  line  voltage  is  applied  by  way  of  resis- 
tors R17  and  R21  to  comparator  11-12-8  of  U3.  Resistors  R19  and  R23  set 
the  bias  level  of  this  comparator.  Positive  feedback  resistor  R15  is  used 
to  eliminate  undesirable  oscillation  which  would  otherwise  occur  when  the 
comparator  happened  to  be  biased  into  the  linear  region  of  operation.  As 
will  be  discussed  later  in  the  section  on  Reset  System  operation,  this 
comparator  operates  in  conjunction  with  NAND  gates  9-10-11-8  and  3-A-5-6  of 
U4,  inverters  9-8  and  11-10  of  U5,  and  the  Reset  System  to  maintain  logical 
ONE  enabling  signals  to  enable  circuitry  in  the  Maintenance  Warning  Unit 
and  Crew  Readout  Unit.  Under  normal  no-fail  conditions,  the  logical  ONE 
signals  maintain  the  enabling  networks  in  a conductive  state  and,  thereby, 
maintain  power  to  the  display  and  relay  circuitry  in  the  Maintenance  Warn- 
ing Unit  and  Crew  Readout  Unit. 

Should  a loss  or  interruption  of  line  power  occur,  comparator  11-12-8 
provides  a logical  ZERO  to  NAND  gates  9-10-11-8  and  3-4-5-6  of  U4  which 
change  the  outputs  of  inverters  9-8  and  11-10  respectively,  from  a logical 
ONE  to  a logical  ZERO.  As  a result,  the  enable  circuits  in  the  Maintenance 
Warning  Unit  and  Crew  Readout  Unit  are  deactivated,  and  power  to  all  relay 
circuitry  is  removed. 

6.  SYSTEM  RESET 

When  power  is  first  applied  to  the  IFOS,  the  various  flip-flops  and 
monostables  in  the  system  assume  unpredictable  states.  These  states  are  a 
function  of  many  unknown  factors,  including  manufacturing  tolerances.  At 
this  time,  improper  signals  are  sent  to  the  Crew  Readout  Unit  and  to  the 
Maintenance  Warning  Unit,  which  could  cause  the  latching  relays  of  those 
units  to  latch  in  improper  positions,  and  thus  present  a false  and  mislead- 
ing display.  Therefore,  when  power  is  applied  to  the  system,  the  relay- 
driver  power  supply  must  not  be  energized  until  a "reset"  signal  has  been 
applied  to  various  circuits  in  the  Central  Computer  Unit  to  place  them  in 
their  proper  states. 

Further,  when  power  is  removed  from  the  system,  improper  relay  latch- 
ing is  again  possible.  As  the  supply  voltages  fall  toward  zero,  the  vari- 
ous circuits  will  begin  to  malfunction,  and  again  improper  signals  are 
sent  to  the  CRU  and  the  MWU.  Hence,  the  relay-driver  power  supply  must  be 
rapidly  turned  off  before  any  of  the  other  circuits  begin  to  malfunction. 
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It  is  also  necessary  to  have  a means  for  manual  resetting  of  the 
various  latching  relays  of  the  system,  after  mainenance  work  has  been  done, 
for  example. 

To  summarize,  the  system  reset  circuitry  must  perform  these  functions 

1.  Issue  a "reset  pulse"  to  all  CCU  circuits  (but  not  CRU  or  MWU 
circuits)  when  power  has  been  applied  and  when  the  input  volt- 
age has  risen  to  a satisfactory  level. 

2.  Turn  on  the  power  supply  to  the  CRU  and  MWU  relay  drivers  after 
the  reset  pulse  has  been  issued. 

3.  Turn  off  the  power  to  the  relay  drivers  rapidly  whenever  the 
main  input  voltage  falls  to  levels  too  low  for  satisfactory 
operation. 

4.  Reset  the  latching  relays  of  the  CRU  and  the  MWU  when  the  manual 
RESET  button  is  pressed. 

The  circuitry  to  accomplish  the  above  is  physically  located  on  the 
Reset  printed-circuit  board  (A5)  and  on  the  Voltage  Monitor  Board  (A10) . 
Schematic  diagrams  are  found  in  Figure  26.  For  the  convenience  of  the 
reader,  part  of  this  circuitry  is  also  shown  in  Figure  28. 

6.1  Description  of  Operation 

First,  consider  the  first  three  functions  above.  When  power  is 
applied  to  the  CCU  and  reaches  a voltage  of  about  14V,  the  output  from  the 
11-12-8  section  of  comparator  U3  (on  A10)  becomes  a ONE.  This  is  sent  to 
the  Reset  board  as  the  "28V  MONITOR"  signal.  This  comparator  is  of 
straight-forward  design,  except  that  feedback  resistor  R15  has  been  added. 
This  resistor  prevents  oscillation  which  would  otherwise  occur  when  the 
comparator  was  biased  in  the  linear  region. 

On  the  Reset  board,  the  28  V MONITOR  signal  releases  the  two  U1 
monostable  circuits  from  the  direct  clear  condition,  gates  on  the  +5  V 
power  to  the  rest  of  the  circuitry,  and  provides  one  input  to  U3  NAND 
gate.  When  capacitor  C2  charges  up  to  a few  volts,  the  monostable  4-5-6 
of  U1  is  triggered  by  the  negative-going  signal  on  pin  8 of  U3. 

The  positive-going  signal  on  pin  6 of  U1  in  turn  triggers  monostable 
11-12-10  of  Ul.  Thus,  both  monostables  are  triggered  at  about  the  same 
time.  Monostable  4-5-6  has  a period  of  about  2.0  seconds,  while  11-12-10 
has  a period  of  about  3.2  seconds. 

When  the  monostable  4-5-6  triggers,  a reset  pulse  is  generated  and 
sent  to  the  Clock  Generator  by  circuits  not  shown  in  Figure  28.  About 
2.0  seconds  later,  when  the  4-5-6  monostable  returns  to  its  normal  state, 
a second  reset  pulse  is  generated. 

At  the  end  of  3.2  seconds,  the  other  monostable  returns  to  its 
normal  state.  Pin  10  of  Ul  becomes  a ZERO  which  results  in  a ONE  on 
board-connector  pin  10,  which  is  labeled  "Reset  Delay,"  and  which  is 
sent  to  a printed-circuit  board  A10. 


On  A10 , the  Reset  Delay  signal  Is  applied  to  NAND  gates  9-10-11  and 
3-4-5  of  U4.  By  this  time,  the  +5V  power  supply  will  be  in  normal  opera- 
tion and  there  will  be  a ONE  on  pin  15  of  U3.  Of  course,  pins  5 and  10 
of  U4  are  ONE  as  these  pins  are  connected  to  the  28V  MONITOR  line.  Thus 
all  inputs  to  both  NAND  gates  are  ONE,  and  the  MWU  and  CRU  relay  enable 
signals  become  ONE.  These  enables  then  cause  power  to  be  applied  to  the 
MWU  and  CRU  relay-drivers,  and  normal  system  operation  begins. 

When  the  input  voltage  falls  down  to  a value  where  the  various  power 
supplies  begin  to  malfunction,  the  28  V MONITOR  signal  goes  to  ZERO  which 
makes  the  relay  enable  signals  quickly  go  to  ZERO  and  hence  quickly  re- 
moves power  from  the  relay-drivers.  Also,  the  two  monostables  on  A5  are 
forced  to  the  CLEAR  state  (if  they  are  not  already  in  that  state)  in  pre- 
paration for  a new  power-on  sequence. 

Because  of  various  timing  problems,  on  occasion  pulses  appear  on 
the  outputs  of  the  U4  NAND  gates  of  A10,  at  inappropriate  times.  Compon- 
ents C14,  C15,  R31,  R32,  R33  and  R34  form  low-pass  filters  to  remove  these 
unwanted  pulses. 

The  latching  relays  of  the  MWU  AND  THE  CRU  can  be  reset  by  pushing 
the  RESET  button  on  the  MWU.  Signals  from  the  switch  are  "debounced"  by 
two  U4  NAND  gates  on  board  A5.  The  output  from  the  debouncing  circuit 
triggers  the  monostable  11-12-10  of  U2,  which  has  a period  of  1.0  second. 
The  output  from  the  monostable  is  inverted  and  sent  to  the  MWU  to  activate 
the  reset  relay.  This  reset  action  is  inhibited  during  the  normal  3.2 
second  turn-on  delay  by  the  connection  to  pin  13  of  U2  on  board  A5. 
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CREW  READOUT  UNIT 


I.  APPROACH 

The  Crew  Readout  Unit  contains  a red  FIRE  warning  lamp,  a white  FIRE 
FAIL  warning  lamp,  an  amber  OVERHEAT  warning  lamp,  a white  OVERHEAT  FAIL 
warning  lamp,  and  an  indicator  lamp  test  switch. 

The  approach  which  was  selected  for  handling  this  display  was  the 
employment  of  transistor-amplifier-driven  relays  sensing  logic  network 
signals  from  the  Computer  Control  Unit  and  providing  contact  actuation  of 
the  visible  warning  displays. 


2.  CREW  READOUT  POWER 

As  shown  in  Figure  29,  the  28  DCV  input  power  first  passes  through  a 
transient  and  reverse  voltage  protection  network  and  then  goes  to  two  12 
DCV  power  supplies.  One  supply  is  for  powering  the  indicator  lamps,  while 
the  other  supplies  power  to  the  relay  coils  and  the  transistor  drivers. 

The  output  from  the  "Relay  Regulator"  power  supply  is  gated  by  the  "Relay- 
Enable"  network. 

2.1  Transient  and  Reverse  Voltage  Protection 

As  with  the  Computer  Control  Unit,  reverse  voltage  protection  is 
accomplished  by  way  of  a fast-recovery  power  rectifier  connected  in  series 
with  the  28  DCV  input  power  line. 

DC  power  is  applied  by  way  of  the  rectifier  to  the  transient  suppres- 
sion network  which  consists  of  an  inductor-resistor  circuit  connected  in 
series  with  both  the  relay  power  supply  and  the  lamp  power  supply,  a clamp- 
ing zener  diode  network  and  a capacitor.  See  Figure  30.  The  capacitor  is 
necessary  to  prevent  the  relay  and  lamp  power  supplies  from  developing 
oscillations . 

2.2  Relay  Power  Disable  Circuitry  (Refer  to  Figure  30.) 

The  relay  power  disable  circuit  is  employed  to  provide  power  to  the 
relay  circuits  during  normal  operation  conditions.  Here,  a continuous 
logic  ONE  signal,  provided  by  the  voltage  monitor  and  reference  supply 
circuitry  in  the  Computer  Control  Unit,  is  applied  to  transistor  Q2,  which 
maintains  series  transistor  Q1  in  a conducting  state,  providing,  thereby, 
power  to  relay  circuitry.  Should  a power  failure  or  power  interruption 
occur  in  the  Computer  Control  Unit,  this  continuous  signal  is  immediately 
removed  and  relay  power  is  disabled.  By  way  of  the  voltage  monitoring 
circuitry,  the  reference  supply,  and  a system  reset  circuit  (refer  to 
Figure  28)  the  continuous  logical  ONE  signal  is  reapplied  a few  seconds 
after  the  resumption  of  Computer  Control  Unit  power,  enabling  power  to  be 
reapplied  to  the  relays.  This  delay  is  used  to  allow  all  logic  circuitry 
in  the  Computer  Control  Unit  to  be  stabilized  prior  to  the  reapplication 
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of  relay  power  so  that  random  signals  In  the  computer  due  to  power  start- 
up, are  prevented  from  generating  false  warnings  In  the  CRU. 

2.3  Lamp  Voltage  Regulator 

This  regulator,  powered  by  transient  and  reverse  voltage  protected 
28  DCV  provides  12  DCV  to  the  crew  readout  lamps.  The  regulator  consists 
of  an  integrated  circuit  linear  regulator,  a current-limit-sensing  tran- 
sistor Q2,  and  a series  load  transistor  Ql.  (See  Figure  31.) 

The  load  voltage  of  12  DCV  is  established  by  the  junction  of  refer- 
ence resistors  R1  and  R2  which  are  connected  across  reference  terminal  9 
of  integrated  circuit  regulator  U1  and  common.  The  set  point  voltage  is 
applied  to  reference  sense  terminal  8. 

Output  voltage  is  sensed  at  terminal  5 of  U1  which  in  turn  controls 
the  conduction  of  Ql.  Resistor  R4  provides  a voltage  analog  of  load 
current  which  is  monitored  by  transistor  Q2.  See  reference  (6)  for  fur- 
ther details  of  operation. 

2.5  Relay  Voltage  Regulator 

This  circuitry  is  shown  in  Figure  32.  It  is  a standard,  well-known 
linear  regulator  circuit,  using  an  NPN  series  pass-transistor.  The  inte- 
grated circuit  U1  provides  the  voltage  reference  and  the  error  amplifier 
necessary  for  operation.  Output  voltage  is  determined  in  part  by  resistors 
R4  and  R5 , and  R4  can  be  adjusted  to  set  the  output  voltage  to  the  exact 
value  required. 

The  transistor  Q2,  in  conjunction  with  R2  and  U1  sets  a current 
limit  of  very  roughly  1.5  amperes.  Transistor  Ql  is  the  result  of  an 
earlier  design  and  is  no  longer  used  in  this  circuit. 

Further  details  of  operation  can  be  found  in  reference  (6). 

3.  READOUT  LOGIC  CIRCUITRY 

All  visible  warning  displays  are  actuated  by  transistor-amplifier- 
driven  relay  contacts  (refer  to  Figure  33).  Here,  use  is  made  of  latching 
and  non-latching  relays  in  order  to  provide  proper  control  of  warning 
readout  by  signals  provided  by  the  Computer  Control  Unit  and  Maintenance 
Warning  Unit.  The  use  of  transistor  buffer-type  amplifiers  minimizes  the 
constraints  to  be  encountered  in  logic  network  signal  circuit  design.  In 
addition,  the  attenuating  effects  that  long  runs  (100  feet  between  Compu- 
ter Control  Unit  and  Crew  Readout  Unit)  might  have  on  directly  operated 
lamp  relays  is  eliminated. 

3.1  Overheat  and  Overheat  Fail  Logic 

As  discussed  in  the  work  statement,  the  overheat  signals  from  the 
Computer  Control  Unit  when  properly  combined  in  the  Crew  Readout  Unit  will 
cause  the  operation  of  the  OVERHEAT  lamp  in  the  Crew  Readout  Unit.  An 
additional  overheat  warning,  initiated  by  the  Crew  Readout  Unit,  is  pro- 
vided at  an  electrical  connector  pin  at  the  Computer  Control  Unit  for 
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possible  system  evaluation  monitoring.  Once  initiated  and  until  cleared, 
the  OVERHEAT  warning  will  lock  out  the  OVERHEAT  FAIL  warning,  and  the 
CABLE  FAIL  warning  of  the  corresponding  cables  which  are  sensing  overheat. 

In  addition,  the  Computer  Control  Unit  shall  give  fail  signals  to  the 
Crew  Readout  Unit  when  cables  and/or  their  associated  electronics  test 
fail.  These  signals  will  be  combined  in  the  Crew  Readout  Unit  to  provide 
an  OVERHEAT  FAIL  warning  shall  remain  on  until  the  system  is  checked  and 
reset.  The  OVERHEAT  FAIL  warning  shall  override  the  OVERHEAT  warning. 

The  OVERHEAT  and  OVERHEAT  FAIL  functions  described  above  are  imple- 
mented by  the  employment  of  four  latching- relay  memory  channels  and  two 
output  relays.  Here,  OVERHEAT  and  OVERHEAT  FAIL  conditions  are  initially 
diagnosed  and  memorized  on  a per-loop  basis  (four  latching  relays,  two  for 
OHA  and  OHFA  and  two  for  OHB  and  OHFB)  and  then,  when  appropriate  condi- 
tions in  both  loop-channel  sections  occur,  displayed  as  system  OVERHEAT 
and  system  OVERHEAT  FAIL  conditions  (OH,  or  OHF,  respectively  provided  by 
the  non-latching  relays). 

The  final  logical  equations  for  system  OVERHEAT  and  system  OVERHEAT 
FAIL  are  as  follows: 

OH  = OHA  OHFA  OHB  OHFB 

+ OHA  OHFA  OHE  OHFB 

+ ORA  OHFA  OHB  MFB 

OHF  = OHFA  OHA  OHFB  OHB 
3.2  Overheat  and  Overheat  Fail  Circuitry 

In  Figure  33,  it  can  be  seen  that  per-channel  signals  for  OVERHEAT, 

OHA  and  OHB,  derived  from  the  per-loop  output  circuits  A and  B in  the  Com- 
puter Control  Unit,  are  applied  to  the  inputs  of  transistor  Q1  and  Q3, 
respectively,  which  activate  the  set  coils  of  latching  relays  K1  and  K3, 
respectively.  For  return  to  normal  conditions  per  channel,  reset  signals 
from  output  circuit  A and  B are  applied  to  transistors  Q7  and  Q8,  respec- 
tively, which  activate  the  reset-coils  of  latching  relays  K1  and  K3 , respec- 
tively. Here,  warning  and  reset  signals  for  this  operation  are  so  con- 
trolled by  the  Computer  Control  Unit  as  to  be  nonconcurrent  in  time. 

In  like  fashion,  per-channel  signals  for  OVERHEAT  FAIL,  OHFA  and 
OHFB,  derived  from  the  signal  correlator  circuit  are  applied  to  the  inputs 
of  transistors  Q2  and  Q4,  respectively,  which  activate  the  set  coils  of 
latching  relays  K2  and  K4 , respectively.  Here,  the  relays  can  be  reset 
only  by  pressing  the  common  reset  button  located  in  the  Maintenance  Warn- 
ing Unit  when  OVERHEAT  FAIL  signals  are  no  longer  present. 

The  occurrence  of  an  overheat  condition  in  channel  A results  in  the 
removal  of  reset  signal  voltage  and  the  application  of  overheat  signal 
voltage  to  transistor  Ql.  This  causes  latching  relay  K1  to  be  set  and 
relay  contacts  Kl-2  and  Kl-7  to  be  transferred.  Here,  the  transfer  of 
Kl-2  locks  out  both  OHFA  set  transistor  Q2  and  the  CFA  set  transistor 
located  in  the  Maintenance  Warning  Unit.  Contacts  Kl-7  provide  the  OVER- 
HEAT channel  A closure  OHA. 
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If  an  A channel  OVERHEAT  FAIL  (HFA)  should  have  occurred  instead, 
however,  the  fail  signal  OHFA  provided  by  the  signal  correlator  would 
have  activated  transistor  Q2  which,  in  turn,  would  have  energized  the  set 
coil  of  OHFA  relay  K2  and  caused  the  transfer  of  relay  contact  K2-2  and 
K2-7.  Here,  the  transfer  of  K2-2  locks  out  OHA  set  transistor  Ql,  and 
provides  the  OVERHEAT  FAIL  channel  A closure  OHFA. 

The  generation  of  OVERHEAT  or  OVERHEAT  FAIL  latchings  for  channel 
B are  accomplished  in  identical  fashion. 

Should  conditions  occur  in  both  loop-channel  systems  A and  B as  to 
generate  any  of  the  optional  combinations  shown  in  the  equation  for  sys- 
tem OVERHEAT  (OH)  discussed  in  paragraph  3.1,  output  relay  K7  will  be 
actuated.  In  turn,  contact  K 7-2  transfers  and  provides  the  5 DCV  signal 
for  the  system  evaluation  monitoring  circuit.  Relay  contact  K7-6  also 
transfers  and  provides  energizing  voltage  to  the  OVERHEAT  lamp,  causing 
a visible  OH  display.  Termination  of  the  OVERHEAT  condition  in  either 
loop-channel  A or  B will  cause  the  OVERHEAT  lamp  to  turn  off. 

When  OVERHEAT  FAIL  conditions  occur  in  both  loop-channel  systems  A 
and  B so  as  to  generate  the  terms  in  the  equation  for  system  OVERHEAT  FAIL 
(OH)  as  discussed  in  paragraph  3.1,  output  relay  K8  will  be  actuated. 

Here,  contact  K.8-6  transfers  and  provides  voltage  to  the  OVERHEAT  FAIL 
lamp,  causing  a visible  display  of  a system  OVERHEAT  FAIL  condition. 

As  with  OVERHEAT,  a return  to  normal  in  either  channel  loop  system 
will  eventually  allow  the  OVERHEAT  FAIL  light  to  go  off  when  the  reset 
button  in  the  MWU  is  depressed. 

3.3  FIRE  and  FIRE  FAIL  Output  Logic 

As  discussed  previously,  the  FIRE  and  FIRE  FAIL  signals  produced  by 
the  Computer  Control  Unit  operate  red  and  white  warning  lights,  respec- 
tively. Once  activated,  the  FIRE  FAIL  warning  remains  on  until  the  system 
is  checked  and  reset.  The  FIRE  FAIL  warning  shall  override  the  FIRE  warn- 
ing. These  functions  are  implemented  in  the  Crew  Readout  Unit  by  the 
employment  of  a non-latching  relay  for  FIRE  and  a latching  relay  for  FIRE 
FAIL.  The  signal  for  a system  FIRE  condition,  FW,  is  obtained  from  the 
FIRE  FAIL  and  U/V  computer  diagnostic  circuitry  (refer  to  Figure  13  and 
Section  1.4  of  Chapter  IV).  The  FIRE  FAIL  warning  signal  is  obtained  from 
the  signal  correlator  circuit  (refer  to  Figure  18  and  Section  2.4  of 
Chapter  IV) . 

3.4  FIRE  and  FIRE  FAIL  Circuitry 

The  FIRE  signal  generated  in  the  computer  diagnostic  circuitry  is 
applied  to  the  input  circuit  of  buffer-transistor  Q5  which,  in  turn, 
actuates  non-latching  relay  K5.  Here,  the  contacts  on  K5  now  transfer 
and  energize  the  FIRE  WARNING  light  and  also  provide  the  5 DCV  signal  for 
the  system  evaluation  monitoring  circuit. 

Should,  on  the  other  hand,  a FIRE  FAIL  condition  occur,  the  Com- 
puter Control  Unit  applies  FIRE  FAIL  warning  signal  FFW  to  the  input 
circuitry  of  buffer  transistor  Q6 , which,  in  turn,  actuates  the  set  coil 
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of  latching  relay  K6.  As  a result,  contact  K6-2  transfers  and  cuts  out 
power  access  to  the  FIRE  light  and  energizes  the  FIRE  FAIL  light.  Also, 
contact  K6-7  transfers  and  removes  5 DCV  from  the  system  evaluation 
monitoring  circuit.  A return  to  normal  (no  faults)  condition  will  cause 
the  removal  of  the  FIRE  FAIL  warning  signal  and  permits  turn-off  of  the 
FIRE  FAIL  light  when  the  reset  button  in  the  Maintenance  Warning  Unit  is 
pressed.  Here,  the  pressing  of  the  reset  button  results  in  a momentary 
closure  of  the  circuit  which  energizes  reset  coil  of  latching  relay  K6. 

3.5  CCU  Power  Fail  Indication 

In  order  to  provide  a positive  indication  of  failure  of  power  to 
the  CCU,  a relay  K9  was  added  to  the  CRU  logic  circuitry.  During  normal 
standby  operation,  K9  is  energized  by  the  12  DCV  relay  power,  and  there 
is  no  electrical  path  between  contacts  2 and  4.  If  CCU  power  should 
fail,  the  Relay  Enable  signal  will  become  ZERO,  and  the  circuitry  dis- 
cussed in  Section  2.2  will  remove  the  12  DCV  relay  power.  Relay  K9  will 
then  no  longer  be  energized,  contacts  2 and  4 will  be  connected,  and  the 
FIRE  FAIL  and  OVERHEAT  FAIL  lamps  will  be  energized  through  diodes  CR21 
and  CR24.  Relay  K9  is  not  a latching  relay,  and  so  when  power  returns  to 
the  CCU,  the  FIRE  FAIL  and  OVERHEAT  FAIL  lamps  will  go  off  automatically. 

3.6  Lamp  Test 

Isolation  diodes  CR20,  CR22,  CR23  and  CR25  are  employed  to  allow 
testing  of  crew  readout  lamps.  Here,  in  the  forward  direction,  the  diodes 
provide  a path  for  lamp  current  flow  to  the  common  test  switch  which  by- 
passes the  associated  relay  contacts.  The  reverse  blocking  character  of 
the  diodes,  however,  prevents  the  inadvertent  turn-on  of  all  lights  when 
any  single  relay  is  activated. 


106 


MAINTENANCE  WARNING  UNIT 


1.  APPROACH 

It  is  the  purpose  of  the  MWU  to  provide  a positive  indication  of 
defective  sensors  or  electronic  components.  To  this  end,  the  front  panel 
has  fifteen  illuminated  indicators.  A lamp  test  switch  and  a lamp  dimmer 
control  are  also  provided,  as  is  a system  reset  switch. 

All  indications  are  of  the  "latching"  type--once  they  appear,  they 
will  remain  until  intentionally  removed.  In  this  way,  intermittent  de- 
fects can  be  readily  signaled. 

The  fifteen  indicators  are: 

a.  UV11,  UV12  ...  UV62.  These  indicate  a defective  U/V  sensor 
tube,  the  first  number  indicating  the  head,  the  second  number 
indicating  which  tube  within  the  head. 

b.  CCU — This  Indicates  a failure  in  the  electronic  circuitry  of  the 
CCU. 

c.  Cable  A,  Cable  B — These  indicate  either  an  open  circuit  or  a 
short  circuit  in  the  corresponding  thermistor  overheat  cable. 

2.  MWU  POWER  SUPPLIES 

As  shown  in  Figure  34,  28  DCV  input  power  first  passes  through  a 
transient  and  reverse-voltage  protection  network  and  then  goes  to  two  12 
DCV  power  supplies.  One  supply  is  for  powering  the  indicator  lamps,  while 
the  other  supplies  power  to  the  relay  coils  and  the  transistor  drivers. 

The  output  from  the  "Relay  Regulator"  power  supply  is  gated  by  the  "Relay 
Enable"  network. 

The  transient  and  reverse-voltage  protection  circuitry,  the  relay 
enable  circuitry,  and  the  relay  power  supply  of  the  MWU  are  all  identical 
to  those  of  the  CRU.  Schematic  diagrams  are  found  in  Figures  30  and  32. 
Descriptions  of  operation  are  found  in  Section  V. 

A schematic  diagram  of  the  MWU  lamp  power  supply  is  found  in  Figure 
35.  This  unit  is  very  similar  to  the  CRU  lamp  power  supply  whose  opera- 
tion is  described  in  2.3  of  V.  In  the  MWU  supply,  two  transistors  are 
used  in  parallel  for  the  pass  transistor,  and  one  of  the  voltage-setting 
resistors  is  made  variable  to  serve  as  a lamp  dimmer. 

3.  UV  AND  CCU  INDICATORS 

Circuitry  for  these  indicators  is  shown  in  Figure  36.  This  circuitry 
consists  of  thirteen  identical  channels.  In  each  channel,  a ONE  signal 
from  the  CCU  turns  on  a 2N1711  transistor.  Current  through  this  transistor 
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activates  the  set  coil  of  a latching  relay.  The  contacts  of  the  relay 
supply  power  to  the  corresponding  indicator  lamp.  The  relay  can  be  reset 
only  by  pressing  the  reset  button,  by  action  described  below. 

4.  CABLE  VAIL  INDICATORS 

The  circuitry  for  the  cable  fail  indicators  is  shown  in  Figure  36. 
These  two  channels  are  very  similar  to  the  thirteen  channels  described 
above,  except  that  the  transistor  emitters  are  returned  to  common 
("ground")  through  relay  contacts  in  the  CRU.  Thus,  if  an  overheat  con- 
dition is  present  on  channel  A,  cable  fail  A indicator  cannot  be  turned 
on.  Similarly,  an  overheat  condition  on  channel  B inhibits  the  cable 
fall  B indicator. 

5.  MANUAL  RESET 

When  the  reset  button  is  pressed,  a ONE  is  sent  back  to  the  CCU . 
After  debouncing  and  other  processing,  a ONE  signal  is  sent  back  to  the 
MWU.  This  is  applied  to  E20  in  Figure  36.  This  signal  is  amplified  by 
transistors  Q8  and  Q9 , and  then  activates  a non-latching  relay,  K8. 
Contact  1 of  K8  energizes  all  reset  coils  of  the  latching  relays  of  the 
MWU  and  the  CRU.  Contact  8 of  K8  shorts  all  transistor  inputs  (of  both 
MWU  and  CRU)  to  common  to  present  the  set  coils  from  being  energized 
at  the  same  time  the  reset  coils  are. 
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VII. 


EXAMINATION  OF  PERFORMANCE 


1.  TESTS  PERFORMED 

In  accordance  with  contract  requirements,  the  first  IFOS  constructed 
was  tested  extensively.  The  complete  test  procedure  is  given  in  Appendix 

V. 

2.  TEST  RESULTS 

The  test  report  of  the  McGraw-Edison  Quality  Control  engineer,  to- 
gether with  test  data  sheets,  is  given  in  Appendix  VI. 

Generally  speaking,  all  of  the  tests  were  passed  by  the  IFOS,  except- 
ing vibrational  and  EMI  tests. 

Mechanical  failures  under  vibration  necessitated  the  use  of  external 
shock  absorbers  in  order  to  continue  the  tests.  This  was  not  a very  satis- 
factory solution  as  it  makes  front-panel  mounting  impossible.  According 
to  a McGraw-Edison  mechanical  engineer  who  examined  the  test  results,  the 
vibrational  failure  problems  could  easily  be  overcome  in  the  design  of  a 
production  model,  without  the  use  of  external  shock  absorbers. 

During  EMI  testing,  no  conducted  or  radiated  susceptibility  problems 
were  encountered,  but  excessive  conducted  and  radiated  emission  was 
observed. 

This  undesired  interference  appears  to  originate  in  these  places: 
the  "lamp  regulators"  of  the  MWU  and  CRU,  and  the  switching  regulators  and 
power  inverter  circuit  of  the  CCU. 

The  lamp  regulators  cause  interference  because  they  oscillate.  These 
regulators  are  of  the  negative-feedback  linear  type,  and  oscillations  are 
readily  eliminated  by  minor  circuit  changes.  (Possible  changes  include 
different  component  values,  different  component  lay-out,  and  additional 
capacitors.)  All  remaining  problems  would  then  originate  in  the  CCU. 

Now  oscillations  cannot  be  eliminated  in  switching  regulators  or  in 
inverters,  since  these  circuits  work  only  because  they  do  oscillate.  How- 
ever, by  better  filtering  of  the  power  leads  to  the  CCU,  the  a.c.  energy 
causing  interference  could  be  prevented  from  leaving  the  metal  box  by  con- 
duction. (The  present  filters  are  of  the  "L"  type,  oriented  to  prevent 
energy  from  entering  the  box.  Further,  the  power  "return"  lead  is  un- 
filtered. Large  filters  of  the  'V  type  on  all  power  leads  would  prevent 
energy  from  being  conducted  out  of  the  metal  box  as  well  as  from  entering 
it.) 

Suppressing  the  energy  leaving  the  box  by  conduction,  together  with 
an  improved  grounding  system,  would  probably  also  eliminate  interference 
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leaving  the  system  by  radiation,  although  one  cannot  be  certain  of  this 
without  actual  trials. 


RELIABILITY  ANALYSIS 

A theoretical  study  of  IFOS  reliability  is  given  in  Appendix  VII. 
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VIII. 


CONCLUSIONS  AND  RECOMMENDATIONS 


The  Statement  of  Work,  which  is  a part  of  the  contract  for  the  IFOS 
project,  indicates  that: 

The  objective  of  this  program  is  to  develop  a flight 
qualifiable  Integrated  System  with  a potential  applica- 
tion for  the  engine  compartments  of  an  advanced  multi- 
engine  bomber/transport  aircraft.  This  system  will 
distinguish  between  a fire  and  an  overheat  condition 
and  provide  highly  reliable  hazard  detection  capability. 

This  objective  was  met  by  the  three  systems  delivered  to  the  Air  Force  in 
June,  1976.  These  systems  demonstrate  that  high  reliability,  automatic 
fire  and  overheat  detection  systems  are  definitely  feasible. 

It  is  evident  from  the  test  results  given  in  Chapter  VII  that  a 
number  of  defects  are  present  in  the  mechanical  design.  These  defects 
necessitated  the  use  of  external  shock  absorbers,  which  in  turn,  made 
front-panel  mounting  of  the  MWU  and  the  CRU  impossible.  These  defects, 
however,  could  easily  be  overcome  in  the  design  of  a production  model. 

In  the  course  of  carrying  out  the  IFOS  project,  several  other  areas 
of  possible  improvement  became  apparent.  The  remainder  of  this  chapter 
lists  and  details  such  possibilities. 

I.  IMPORTANT  SYSTEM  CHARACTERISTICS 

Important  characteristics  for  a system  for  fire  and  overheat  warning 
include : 

A.  Size 

B . Weight 

C.  Reliability 

D.  Power  consumption 

E.  Cost 

F.  Physical  ruggedness 

G.  Response  speed 

H.  Sensitivity  (to  flame) 

I.  Stability  of  parameters  (alarm  temperature  for  overheat) 

J.  Ease,  speed  and  cost  of  maintenance 

Various  degrees  of  improvement  seem  readily  possible  for  the  first 
five  characteristics  and  for  the  last  one  listed.  More  specific  sugges- 
tions are  given  below. 

It  is  assumed  that  the  complete  system  will  consist  of  a Computer 
Control  Unit  (CCU) , a Crew  Readout  Unit  (CRU),  a Maintenance  Warning  Unit 
(MWU),  Detector  Heads,  Overheat  Cables  and  connecting  cables. 
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The  contract  goals  referred  to  in  the  discussion  are  "System  Weight 
Volume  Goals”  of  Contract  F33615-72-C-1053. 

2.  SIZE,  WEIGHT  & POWER  CONSUMPTION 

2.1  Computer  Control  Unit 

Most  of  the  volume  and  weight  of  the  present  CCU  stems  from  the  logic 
cards,  their  sockets,  housing  and  associated  wiring,  and  from  the  various 
circuits  used  to  supply  power  to  the  logic  circuits  and  the  detector  heads. 

The  size  and  weight  of  the  logic  circuitry  could  be  reduced  by  a 
factor  of  at  least  two  or  three  by  the  use  of  a different  logic  design  or 
by  the  use  of  a microprocessor.  With  the  aid  of  a custom-made  LSI  chip, 
all  of  the  logic  could  be  placed  on  a single  4"  x 5"  printed-circuit  card, 
but  such  a chip  would  be  very  expensive  to  design  and  produce. 

Power  consumption  of  the  logic  circuitry  could  be  reduced  by  the 
same  measures  that  reduce  size  and  weight  and  also  by  the  use  of  CMOS  logic 
elements  to  replace  the  present  TTL  elements. 

At  least  half  of  the  input  power  to  the  present  system  goes  into  the 
operation  of  the  sensor  tubes  in  the  detector  heads.  By  placing  small 
transformers  in  the  detector  heads,  it  should  be  possible  to  make  the 
stand-by  power  consumption  smaller.  With  a current-limiting  circuit,  the 
power  consumption  could  be  kept  low  even  under  intense  fire  conditions. 
Reduced  power  consumption  would  lead  to  smaller  and  lighter  power  supplies 
with  reduced  heat  dissipation. 

With  the  changes  suggested  above,  the  overall  dimensions  of  the  CCU 
might  be  reduced  from  the  present  7-1/2”  x 12"  x 19"  to  about  5"  x 6"  x 12". 
Stand-by  power  consumption  might  be  reduced  to  5 or  10  watts  from  the  pres- 
ent 28  watts.  It  is  difficult  to  see  how  the  contract  goal  of  24  cubic 
inches  could  be  met. 

It  is  anticipated  that  the  weight  reduction  would  be  in  the  range  of 
50  to  75%  of  the  present  CCU  weight  of  30#,  13  oz.  and  a follow-on  program 
CCU  weight  design  objective  of  8#  could  be  established. 

2.2  Crew  Readout  Unit 

Presently,  the  CRU  is  about  5-1/2"  x 5-1/2"  x 8"  in  size  and  weighs 
about  4-1/4  pounds.  There  are  four  internal  circuit  boards.  By  the  use 
of  24V  relays,  the  "Relay  Regulator"  board  could  be  eliminated.  An  im- 
proved "Lamp  Regulator"  would  be  somewhat  smaller  and  would  eliminate  the 
need  for  the  "Transient  Suppressor”  board.  The  circuitry  of  the  "Logic" 
board  could  be  simplified  somewhat  and  could  be  placed  among  the  four 
indicators,  just  behind  the  front  panel.  The  resulting  unit  would  be 
about  4"  x 4"  x 4"  and  would  weight  less  than  2 pounds. 

Because  of  the  current  and  voltage  requirements  of  the  presently- 
used  indicator  lamps,  it  would  not  be  possible  to  eliminate  the  "lamp 
regulator"  board.  The  contract  goal  of  12  cubic  inches  would  seem  to 
require  a different  type  of  indicator. 


2.3  Maintenance  Warning  Unit 


The  present  MWU  is  about  6"  x 6-1/4"  x 9-1/2"  in  size,  and  weighs 
approximately  6-3/4  pounds.  If  a different  type  of  indicator  were  used, 
a dramatic  reduction  in  size  and  weight  would  be  possible.  By  the  use  of 
latching  flag-type  indicators,  it  should  be  possible  to  easily  meet  the 
contract  goals  of  12  cubic  inches  and  .8  lb. 

2.4  Detector  Heads 

Present  flame  detector  heads  measure  about  4"  x 3"  x 3"  and  weigh 
about  2 pounds  each.  By  the  use  of  miniature  sensor  tubes  (now  under 
development  at  McGraw-Edison)  and  a few  minor  design  changes,  it  would 
be  possible  to  reduce  the  size  of  the  head  somewhat.  Of  course,  if  a 
transformer  were  included  in  the  head,  as  discussed  in  2.1,  above,  this 
saving  would  be  used  up.  Inclusion  of  a high-voltage  transformer  for  the 
U/V  sensor  and  a lower-voltage  pulse  transformer  for  the  U/V  source  would 
allow  the  use  of  MIL-Spec  qualified  electrical  connectors  since  the  input 
voltage  to  the  detector  head  could  be  reduced  to  approximately  50V. 

Miniaturization  of  the  detector  head  components  volume  and  weight 
reductions  would  be  offset  by  the  inclusion  of  the  connector  and  trans- 
formers. However,  the  combined  cable  and  detector  head  weight  of  10  lbs, 

7 oz.  would  be  reduced  by  the  use  of  low  voltage  cable.  It  is  antici- 
pated that  this  weight  reduction  would  be  in  the  order  of  50%  with  a 
design  objective  of  5 lbs. 

2.5  Overheat  Cables 

There  is  no  apparent  way  to  reduce  the  size  and  weight  of  the  over- 
heat cables.  They  weigh  a total  of  1-1/2  pounds,  compared  to  the  contract 
goal  of  1/2  pound. 

2.6  Connecting  Cables 

By  use  of  a transformer  in  the  detector  heads,  the  thick,  heavy 
expensive  high-voltage  cable  used  at  present  could  be  replaced  with  much 
smaller,  less  expensive  wire.  Low  voltage  fire  zone  wire  would  result  in 
a weight  reduction  of  67%  resulting  in  a 40  foot  cable  length  weight  of 
3 pounds. 

3.  RELIABILITY  CONSIDERATIONS 

In  the  present  system,  there  are  many  individual  components  whose 
failure  would  lead  to  failure  of  the  entire  system.  By  the  use  of 
greater  redundancy  and  a revised  logic  design,  it  appears  to  be  possible 
to  build  a system  which  would  work  normally  in  spite  of  the  failure  of 
any  one  single  component.  Even  indicators  can  be  made  with  this  feature 
— by  having  two  lamps  illuminating  the  same  jewel  and  energized  from 
separate  circuits,  a burned-out  bulb  will  not  prevent  an  alarm  from  be- 
ing given.  With  the  addition  of  monitoring  photocells  and  SCR  "crow- 
bars," a defective  lamp-driver  circuit  can  be  prevented  trom  giving  a 
false  alarm. 
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The  occasional  failure  of  the  OVERHEAT  indicator  to  come  on  (.tee 
2. 3. 1.1  of  Section  IV)  could  readily  be  overcome  with  a different  logic 
design. 


Reliability  can  further  be  Improved  by  the  use  of  more  reliable  com- 
ponents and  fewer  interconnections.  Thus,  the  use  of  a microprocessor  to 
replace  the  many  separate  integrated  circuits  of  the  present  IFOS  should 
lower  the  failure  rate  considerably. 
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To  obtain  the  full  reliability  permitted  by  a given  design  would 
require  a carefully  designed  and  implemented  reliability  program,  with 
attention  to  the  care  taken  in  production  and  quality  control,  the  condi- 
tions and  time  of  storage,  shipment  conditions,  care  taken  in  installation 
and  human  factors  of  users  and  maintenance  personnel. 


Careful  examination  of  the  meaning  of  reliability  reveals  that  there 
are  several  possible  definitions,  not  equivalent  to  each  other.  To  pro- 
ceed with  a detailed  design  of  an  improved  IFOS,  it  would  be  necessary  to 
define  the  reliability  goals  exactly. 


4.  MAINTENANCE  CONSIDERATIONS 

Some  improvement  in  the  speed  and  ease  of  repair  could  probably  be 
made  by  providing  for  additional  fault  diagnosis  on  the  MWU,  and  by  pro- 
viding convenient  test  points  in  the  CCU,  MWU  and  CRU. 


5.  COST  CONSIDERATIONS 

At  the  present  stage,  it  is  impossible  to  estimate  the  cost  of  an 
improved  IFOS.  The  use  of  a microprocessor  to  replace  many  digital  inte- 
grated circuits  would  hopefully  reduce  both  labor  and  material  costs. 
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APPENDIX  I 


CALCULATION  OF  PROBABILITY  OF  RESPONSE 


The  probability  of  obtaining 
expected  number  of  counts  Is  A,  Is 


N counts 
given  by 


in  a time  interval  where  the 
this  Pois';jn  formula: 


P (N,A) 


.N  a~A 
A e 

N! 


(1) 


It  follows  that  the  probability  of  obtaining  N or  more  counts  in  this  time 
is : 


A - °°  v 

^ 1 AX  e A (2) 

^ , X! 

X - N 

For  later  use  it  is  convenient  to  prepare  a table  of  the  values  of 
(2)  for  various  values  time  intervals.  In  this  table,  we  assume  a tube 
sensitivity  of  15  counts  in  .480  seconds.  (A  time  interval  of  .480 
seconds  was  chosen  rather  than  .500  seconds  to  simplify  the  calculations 
and  to  allow  .02  seconds  for  the  fire  warning  relay  to  close  and  the  in- 
dicator to  respond.)  See  Table  II. 

From  this  table,  an  approximate  answer  to  the  response  time  calcula- 
tion can  be  immediately  determined.  It  is  seen  that  eight  or  more  counts, 
and  hence  a fire  warning,  will  be  obtained  98.2%  of  the  time  within  .480 
seconds.  Since  this  does  not  take  into  account  the  effects  of  the  "reset" 
signals  and  the  test  periods,  a more  accurate  answer  requires  a more 
complex  calculation. 
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TABLE  II 

PROBABILITY  OF  EIGHT  OR  MORE  COUNTS 


TIME 

(T) 

EXPECTED 

SECONDS 

COUNTS  (A) 

PROBABILITY 

.032 

1 

.0000 

.064 

2 

.0011 

.072 

2.25 

.0022 

.096 

3 

.0119 

.104 

3.25 

.0183 

.120 

3.75 

.0377 

.128 

4 

.0511 

.144 

4.50 

.0865 

. 160 

5 

.1334 

. 168 

5.25 

.1607 

.192 

6 

.2560 

.200 

6.25 

.2862 

.208 

6.50 

.3272 

.224 

7 

.4013 

.240 

7.5 

.4753 

.256 

8 

.5470 

.264 

8.25 

.5880 

.288 

9 

.6761 

.296 

9.25 

.7040 

.320 

10 

.7798 

.352 

11 

.8568 

.360 

11.25 

.8770 

.384 

12 

.9105 

.416 

13 

.9460 

.448 

14 

.9684 

.480 

15 

.9820 

.512 

16 

.9900 

.544 

17 

.9946 

.576 

18 

.9971 

.600 

18.75 

.9980 
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The  calculation  of  the  average  alarm  probabilities  was  done  by 
dividing  the  counting  window  into  twenty  intervals  and  individually  cal- 
culating the  alarm  probability  for  a fire  starting  at  each  interval.  A 
sample  calculation  to  obtain  the  probability  of  a specific  response  time 
is  given  below: 

Conditions : 


S = 15  counts  in  .480  seconds 
N «*  8 counts  for  alarm 

M = 1.92  seconds  (minimum  counting  window) 

Calculation  of  the  probability  of  alarm  for  a .480  second  response  time 
assuming  that  the  fire  starts  .192  seconds  before  the  end  of  the  reset 
time  cycle  is  as  follows.  At  0.192  seconds  before  the  end  of  the  cycle, 
the  expected  count  from  Table  II  is  6,  which  corresponds  to  a 0.2560  pro- 
bability of  alarm  at  N * 8 counts.  As  the  probability  is  being  deter- 
mined for  a total  0.480  second  response  time,  during  the  next  reset  cycle 
there  remains  0.480  - .192  or  0.288  seconds  during  which  there  is  an 
additional  probability  of  alarm.  Therefore,  the  total  probability  is 
0.256  + (1-0.2560)  x 0.6761  = 0.7620. 

Similar  calculations  were  made  for  twenty  equal  time  intervals 
within  the  1.92  second  counting  window,  and  averaged  to  get  the  probabil- 
ity for  a 0.480  second  response  time.  Table  III  shows  a summary  of 
probability  calculation  for  various  response  times,  including  probability 
calculations  with  a 0.120  second  test  time.  All  time  intervals  are  equal 
except  the  second  which  was  made  .060  seconds  or  half  the  test  time. 

This  gives  a better  average  for  the  start  of  fire  during  the  test  time 
interval  than  would  be  obtained  with  the  0.096  second  interval.  Although 
the  test  time  adds  to  the  insensitive  time,  and  decreases  the  probability 
of  alarm,  its  effect  is  only  slight  (1%  or  less)  in  view  of  the  fact  that 
it  occurs  only  once  in  six  reset  cycles. 

Finally,  it  is  seen  that  a fire  warning  will  be  given  within  .5 
second  94.34%  of  the  time. 
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APPENDIX  II 


CALCULATION  OF  FALSE  ALARM  PROBABILITY 
Here  it  is  desired  to  evaluate  this  expression: 

AX  "A  v 
A e , where 

X! 

X - 8 

A - ( . 5C/s)  (2.88  sec)  - 1.44 
3 - 2.718  ... 

Using  published  tables  (4)  with  interpolation,  leads  to  a probability  of 
.000132.  This  is  the  probability  of  a false  alarm  per  2.88  second  period. 
The  probability  per  second  is  then  .0000458,  and  the  "mean  time  between 
failures"  is  1/. 0000458  or  21,800  seconds  or  6.04  hours. 

With  two  sensor  tubes  required  to  generate  a fire  alarm,  the  prob- 
ability of  a false  alarm  per  2.88  second  period  is  (.000132)2,  or 
1.74  x 1O-0.  This  leads  to  a probability  per  second  of  .605  x 1O-0,  and 
a "mean  time  between  failures"  of  1.655  x 108  seconds,  or  46,000  hours 
or  960  days. 
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APPENDIX  III 


CALCULATION  OF  FAI LURE-TO-TEST  PROBABILITY 


Here  it  is  desired  to  evaluate  this  expression: 
X = 7 

X -A 

A c , where 


X = 0 

A = 40 
e = 2.718... 

Forty  counts,  rather  than  fifty,  is  taken  as  the  expected  number  to  allow 
for  the  fact  that  component  variations  could  make  the  clock  run  20%  fast. 

Using  published  tables  (4)  leads  to  a probability  of  less  than 
.000001.  Since  the  test  period  could  occur  as  often  as  once  every  11.52 
seconds,  the  probability  of  failure  per  second  is  less  than  .0000000867. 
This  is  equivalent  to  a "mean  time  between  failures"  of  greater  than 
11,520,000  seconds  or  greater  than  3200  hours  or  greater  than  133  days. 


130 


INTEGRATED  FIRE  AND  OVERHEAT  SYSTEM 
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APPENDIX  V 


GENERAL  TEST  PLAN 
FOR 

SYSTEM  PERFORMANCE  TESTS 
INTEGRATED  FIRE  AND  OVERHEAT  DETECTION  SYSTEM 


AIR  FORCE  CONTRACT  F33615-72-C-1053 

MAY  15,  1972 
(REVISED  JUNE  10,  1975) 
(REVISED  DECEMBER  11,  1975) 

REPORT  NUMBER  59377-2 


EDISON  ELECTRONICS  DIVISION 
MCGRAW- ED I SON  COMPANY 
GRENIER  FIELD 
MANCHESTER,  NEW  HAMPSHIRE 
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McGRAW-EDlSON  COMPANY 
Edison  Electronics  Division 


Cfgn.e^fied  A'c.rr  Ma-  r^est-e'-  Nl  m 03103 


TO  Mat  Reiser 
FROM  Dick  Jurentkuff 

Subject:  CORROSION  OF  SHIELDING  BOX  ON 

THE  COMPUTER  CONTROL  UNIT  (I.  F.  O.  S. ) 


date  1 1 June  1976 
cc:  M.  Bober 


As  you  know,  the  shielding  box  (D.vg*  No.  B — 6 1 7 2 5)  when  mounted 
in  the  CCU  showed  signs  of  severe  corrosion  after  the  CCU  went  thru  the 
humidity  test. 

The  print  called  for  the  finish  to  be  cadmium  plate  yellow  chromate 
per  QQ-P-4I6,  Type  II,  Class  3. 

After  reading  the  spec  thru,  I found  that  cadmium  plate  is  not  recom- 
mended for  usage  as  we  did  for  the  shielding  box.  For  instance:  Cadmium 
plated  parts  should  not  be  used  in  a nonventilated  container  with/or  in 
contact  with  electrical  equipment.  Cadmium  plated  parts  should  not  be  in 
an  area  where  there  is  the  presence  of  organic  electrical  insulation,  phenolic 
resinous  substances  and  others  containing  unsaturated  carbon  to  carbon 
linkages  such  as  oil  paints,  potting  compounds,  RTV , etc. 

Just  to  verify  these  facts,  I sent  a shielding  box  to  Plant  #2  to  check 
if  indeed  it  was  cadmium  plated.  Results  were  that  it  was  cadmium  plated 
but  wasn't  able  to  verify  thickness  of  plating.  I then  took  the  same  box, 
submitted  it  for  48  hours  of  salt  spray  which  showed  no  signs  of  corrosion. 

Summary:  Cadmium  plate  is  not  a suitable  plating  to  be  used  in  applica- 
tions such  as  Edison  Electronics  is  doing  now.  It  would  be  my  opinion  not 
to  use  Cadmium  plating  on  any  electronic  equipment.  I would  also  suggest 
that  this  part  should  have  a finish  of  tin  plating  per  MIL-T-  10727,  Type  II. 
Type  II  is  hot  dipped. 


Rj/meg 
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1.0  SCuPE 


This  specification  defines  the  performance  tests  which  will  be  run 
on  the  Integrated  Fire  and  Overheat  Detection  System  for  aircraft  to  ful- 
fill the  requirements  of  Contract  F 3361 5- 72— C— 105 3 , Attachment  1,  paragraph 
IVB. 

2.0  TEST  SYSTEM 

The  test  system  will  consist  of  the  following  parts  with  the  asso- 
ciated interconnecting  cable  assemblies  excepc  as  noted  in  section  4.3  and 
4 . 4 . 


1 Computer  Control  Unit  (CCU) 

1 Maintenance  Warning  Unit  (MWU) 
1 Crew  Readout  Unit  (CRU) 

6 Ultraviolet  Detector  Heads 
1 Dual  Overheat  Cable  Loop 


3.0  TEST  CONDITIONS 

Unless  otherwise  specified,  all  tests  will  be  performed  at  nominal 
input  voltage  and  at  room  temperature,  humidity  and  barometric  pressure. 
Also,  unless  otherwise  specified,  the  test  system  shall  not  be  operated 
during  the  environmental  tests  of  4.3  and  4.4  Also,  the  tests  of  para- 
graph . 2 shall  be  performed  with  cables  one  hundred  feet  in  length  between 
the  Computer  Control  Unit  and  the  readout  units.  All  other  tests  will 
either  be  25  or  100  feet.  Cable  length  between  Computer  Control  Unit  and 
Deteitor  Heads  shall  be  40  feet.  Paragraph  4.2.2  thru  4.2.9  will  be  accom- 
plished outdoors  on  F.dison  grounds.  All  other  tests  will  take  place  under 
standard  Laboratory  conditions. 

4.0  TEST  PROCEDURE 

4.1  Initial  System  Test 

4.1.1 

The  system  shall  be  energized  and  observed  for  proper  operation.  All 
lights  on  the  Maintenance  Warning  Unit  and  Crew  Readout  Unit  shall  be  out. 
The  lamp  switch  on  each  readout  unit  shall  be  pushed  t<  verify  that  all 
lamps  are  operational. 

4.1.2 

Each  Ultra'.',  let  Detector  Head  shall,  i ' It  exposed  to  a satur- 
ating sour  e . t ilti  iviolet  r*  lion.  i s li  light  of  the  Crew 

Readout  Unit  . 1 [..•■  on  dur.  i expos  ut  1 1 ot  t ligh.s  t •;  lining 

unchanged.  The  urce  shal  l tlvn  be  re  i i il  I I warnin,  si,  li  go 
out.  One  Sen.  r in  the  Detector  Head  shall  it  1 n both  from  the 

saturating  sour.t  and  also  from  the  test  s.-,.  - . ,d  tl  tl.er  stnsor  shall 

be  exposed  t*  tin  s .ituratitii,  source.  The  F I K w a or  i ( igl.t  and  the  appro- 
priate sens.'!  li.i  t on  the  Maintenance  Warning  Lo.it  si  .11  come  on.  The 
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shield  shall  be  removed  from  the  first  sensor,  placed  over  the  second  and 
the  RESET  switch  on  the  Maintenance  Warning  Unit  shall  be  pushed.  The 
FIRE  warning  light  shall  again  be  on,  the  first  sensor  light  on  the  Main- 
tenance Warning  Unit  shall  be  out,  and  the  second  sensor  light  on  the 
Maintenance  Warning  Unit  shall  come  on.  This  test  shall  be  repeated  for 
each  Detector  Head. 

4.1.3 

The  test  source  in  each  Detector  Head  shall  be,  in  turn,  shielded 
from  the  sensors.  The  Maintenance  Warning  Unit  lights  for  the  two  sensors 
in  that  Detector  Head  shall  come  on.  With  the  source  still  shielded,  the 
two  sensors  in  the  Detector  Head  shall  be  exposed  to  a saturating  source 
of  ultraviolet  radiation.  The  FIRE  warning  light  on  the  Crew  Readout 
shall  not  come  on  until  the  next  time  the  (shielded)  test  source  is  acti- 
vated. An  adjacent  Detector  Head  shall  be  exposed  to  the  saturating 
source  and  the  FIRE  warning  light  shall  come  on.  The  test  source  shield 
and  the  saturating  source  shall  then  be  removed  and  the  RESET  switch  de- 
pressed. The  associated  lights  on  the  Maintenance  Warning  Unit  and  the 
Crew  Readout  Unit  shall  go  out.  This  test  shall  be  repeated  for  each 
Detector  Head. 

4.1.4 

The  test  sources  in  two  adjacent  Detector  Heads  shall  be  shielded. 
The  lights  on  the  Maintenance  Warning  Unit  for  the  sensors  in  these 
Detector  Heads,  shall  come  on.  The  FIRE  FAIL  light  shall  also  come  on. 

The  shields  shall  then  be  removed  from  the  two  sources  and  no  change  in 
the  condition  of  the  lights  shall  occur.  The  remaining  four  Detector 
Heads  shall  then  be  exposed  to  a saturating  source  of  ultraviolet  radia- 
tion. The  FIRE  warning  light  shall  not  come  on.  This  test  shall  be 
repeated  for  all  adjacent  Detector  Heads. 

4.1.5 

Both  dual  Overheat  Cables  shall  be  heated  with  a localized  heating 
or  in  an  oven.  The  OVERHEAT  light  on  the  Crew  Readout  Unit  shall  come  on 
during  the  exposure  with  all  other  lights  remaining  unchanged.  The  heat 
source  shall  then  be  removed  and  the  OVERHEAT  light  shall  go  out.  One 
cable  shall  then  be  disconnected  at  one  end  from  the  circuit.  The  heat 
shall  then  be  applied  to  both  cables  and  the  appropriate  cable  light  on 
the  Maintenance  Warning  Unit  and  the  OVERHEAT  light  shall  come  on.  The 
heat  shall  be  removed  and  the  overheat  light  shall  go  out.  The  first 
cable  shall  be  reconnected  to  the  circuit,  the  second  cable  disconnected 
and  the  reset  button  pushed.  The  appropriate  change  shall  occur  on  the 
Maintenance  Warning  Lights.  Heat  shall  then  be  applied  to  both  cables  and 
the  OVERHEAT  light  shall  come  on.  The  heat  shall  be  removed  and  the 
OVERHEAT  light  shall  go  out.  The  second  cable  shall  be  reconnected  and 
the  Reset  button  pushed.  The  appropriate  change  shall  occur  on  the  Main- 
tenance Warning  Lights.  Heat  shall  then  be  applied  to  both  cables  and  the 
OVERHEAT  light  shall  come  on.  The  heat  shall  be  removed  and  the  OVERHEAT 
light  shall  go  out. 

4.1.6 

The  "lower"  ends  of  both  cables  shall  be  disconnected  from  the  cir- 
cuit. The  appropriate  cable  lights  on  the  Maintenance  Warning  Unit  and 
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the  OVERHEAT  FAIL  light  on  the  Crew  Readout  Unit  shall  come  on.  The  cables 
shall  then  be  heated  with  localized  heating  or  in  an  oven.  The  OVERHEAT 
light  shall  not  come  on.  Heat  shall  be  removed  and  the  cables  shall  then 
be  reconnected  and  the  Reset  button  pushed.  The  cable  lights  on  the  Main- 
tenance Warning  Unit  and  the  OVERHEAT  FAIL  light  shall  go  out. 

4.1.7 


One  of  the  dual  Overheat  Cables  shall  be  disconnected  at  the  "lower" 
end  from  the  Computer  Control  Unit  and  shorted  from  center  wire  to  sheath. 
The  appropriate  light  on  the  Maintenance  Warning  Unit  shall  come  on.  The 
second  cable  shall  similarly  be  disconnected  and  shorted.  The  OVERHEAT 
FAIL  light  shall  come  on  in  addition  to  the  appropriate  Maintenance  Warn- 
ing Unit  light.  Both  cables  shall  be  reconnected  to  the  Computer  Control 
Unit  with  the  shorts  removed  and  the  Reset  button  pushed.  The  Maintenance 
Warning  Unit  lights  and  OVERHEAT  FAIL  light  shall  go  out. 

4.1.8 


The  power  input  to  the  Computer  Control  Unit  shall  be  interrupted. 
Both  the  FIRE  FAIL  and  the  OVERHEAT  FAIL  lights  on  the  Crew  Readout  Unit 

shall  come  on. 

4.1.9 


One  ultraviolet  Detector  Head  and  one  Overheat  Cable  shall  be  dis- 
connected from  the  Computer  Control  Unit.  The  appropriate  lights  on  the 
Maintenance  Warning  Unit  shall  come  on.  Power  to  the  system  shall  be 
removed  for  a period  of  three  hours  and  then  reapplied.  When  power  is 
reapplied,  the  Maintenance  Warning  Unit  lights  shall  return  to  their  status 
before  power  was  removed. 

4.2  Performance  Test 

4.2.1  Overheat  Cable  Calibration  Test 

The  overheat  cables  shall  be  placed  in  a calibrated  oven  or  bath 
with  the  balance  of  the  system  at  room  ambient  conditions.  The  oven  or 
bath  temperature  shall  be  raised  to  within  100°F  of  the  cable  alarm 
temperature  and  then  increased  at  a rate  not  exceeding  4°F  per  minute 
until  the  OVERHEAT  light  comes  on.  The  control  shall  alarm  within  ±5% 
of  its  normal  alarm  temperature. 

4.2.2  Detector  Head  Calibration  Test 

Each  Detector  Head  shall  in  turn  be  exposed  to  the  fire  of  paragraph 
4.5  of  MIL-D-27729A.  The  FIRE  light  shall  come  on  within  500  milliseconds, 
at  least  90%  of  the  time,  when  the  Detector  Head  is  4 feet  away  from  the 
flame  along  its  center  line.  Following  alarm,  approximately  one-half 
(design  goal  1/2),  the  flame  front  of  the  test  fire  shall  be  physically 
blocked  from  the  Detector  Head  view  and  the  alarm  indication  shall  con- 
tinue to  hold.  Following  this,  the  flame  shall  be  completely  blocked  from 
the  Detector  Head  view  and  the  FIRE  light  shall  go  out  within  0.2  to  1.5 
seconds.  These  tests  shall  be  performed  under  various  steady  state  power 
inputs  of  MIL-STD-704  except  the  low  voltage  limit  should  not  be  less  than 
18  VDC.  This  test  sequence  shall  be  repeated  for  each  Detector  Head. 
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At  the  completion  of  this  test  utilizing  fire  of  MIL-D-27729A , para- 
graph 4.5,  qualify  and  calibrate  substitute  propane  flame  source  for 
equivalent  response  and  profile  characteristics  for  inside  laboratory  use. 

A. 2. 3 Detector  Head  Cone  of  Vision 

Each  Detector  Head  shall  be  tested  for  cone  of  vision  in  the  hori- 
zontal and  vertical  planes  at  40°  off  the  center  line  using  the  test  fire 
paragraph  4.5  of  MIL-D-27729A.  The  FIRE  warning  light  shall  come  on 
within  500  milliseconds,  at  least  90%  of  the  time,  when  the  Detector  Head 
is  4 feet  away  from  the  flame.  Following  alarm,  one-half  the  flame  front 
of  the  test  fire  shall  be  physically  blocked  from  the  Detector  Head  view 
and  the  alarm  indication  shall  continue  to  hold.  This  test  sequence  shall 
be  repeated  for  each  Detector  Head. 

4.2.4  Detector  Head  Attenuation  Test 

Each  Detector  Head  shall  continue  to  function  and  cause  an  alarm 
when  exposed  to  a rapidly  burning  5-inch  diameter  pan  of  gasoline  (100 
octane)  or  JP4  fuel  with  and  without  the  addition  of  30  percent  by  volume 
of  hydraulic  fluid  when  the  window  in  the  Detector  Head  is  coated  with 
JP4  fuel.  There  shall  be  a minimum  air  flow  of  100  CFM  across  this  window. 
The  FIRE  light  shall  come  on  when  the  Detector  Head  to  test-flame  distance 
is  no  less  than  2 feet  along  its  center  line.  This  test  sequence  shall 
be  repeated  for  each  Detector  Head. 

4.2.5  Overheat  Cable  Power  Variation  Tests 

Flame  tests  in  accordance  with  paragraph  4.5.4  of  MIL-F-7872C  shall 
be  performed  on  the  Overheat  Cables  under  the  various  steady  state  input 
power  conditions  specified  in  MIL-STD-704  except  the  low  voltage  limit 
should  not  be  less  than  18  VDC.  This  limit  applies  to  all  overheat  cable 
tests,  in  particular.  General  Test  Plan  paragraphs  4.2.6,  4.2.7,  4.2.8  and 
4.2.9.  In  each  case,  an  alarm  shall  occur  in  not  more  than  5 seconds 
after  exposure  to  flame  and  shall  clear  in  not  more  than  30  seconds  after 
removal  of  the  flame. 

4.2.6  Overheat  Cable  Response  Time  with  815°C  (1500°F)  Flame 

Flame  tests  shall  be  conducted  on  the  Overheat  Cables  in  accordance 
with  4.5.4  of  MIL-F-7872C  using  a flame  temperature  of  815°C  (1500°F).  An 
alarm  shall  occur  in  not  more  than  10  seconds  after  flame  application. 

4.2.7  Overheat  Cable  Reset  Time 

The  flame  test  of  paragraph  4.5.4  of  M1L-F-7872C  shall  be  applied 
to  the  Overheat  Cables  for  a period  of  at  least  one  minute.  The  flame 
shall  then  be  removed.  Within  5 seconds  after  the  alarm  has  cleared,  the 
flame  shall  be  reapplied  and  an  alarm  shall  occur  in  not  more  than  5 
seconds . 
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4.2.8  Overheat  Cable  Partial  Extinguishment  Test 


1 


The  flame  tests  of  paragraph  4.5.4  of  MIL-F-7872C  shall  be  applied 
to  the  Overheat  Cables  for  a period  of  30  seconds.  The  test  flame  shall 
then  be  masked  so  as  to  reduce  its  effective  area  of  contact  by  approxi- 
mately 50  percent.  The  alarm  signal  shall  not  clear.  After  an  additional 
30  seconds,  the  flame  shall  be  removed  entirely  and  the  alarm  signal  shall 
then  clear  in  not  more  than  30  seconds. 

4.2.9  Overheat  Cable  Repeated  Response  and  Clearance  Time  Test 

The  flame  test  of  paragraph  4.5.4  of  MIL-F-7872C  shall  be  applied 
for  two  periods  of  at  least  one  minute  each.  The  cables  shall  be  cooled 
to  room  temperature  or  to  the  alternate  temperature  permitted  by  paragraph 
4.5. 1.1  of  MIL-F-7872C  after  each  exposure  to  flame.  The  flame  shall  then 
be  applied  a third  time  to  the  same  portion  previously  heated.  An  alarm 
signal  shall  occur  in  not  more  than  5 seconds  after  each  exposure  to  flame, 
the  alarm  shall  clear  in  not  more  than  30  seconds  after  the  flame  has  been 
removed.  Artificial  means  of  cooling  the  cables  shall  not  be  used.  Dur- 
ing these  tests,  the  cable  elements  subjected  to  the  flame  shall  be 
vibrated  at  an  acceleration  of  10  g at  a frequency  of  30  cycles  per  second. 
This  vibration  may  be  produced  by  a mechanical  means  such  as  an  1800  rpm 
motor  driving  an  eccentric  arm  or  cam. 

4.2.10  Overheat  Cable  Salt  Water  Immersion  Test 

With  the  system  operating  at  standby,  the  Overheat  Cables  shall  be 
disconnected  at  a convenient  point.  The  OVERHEAT  FAIL  light  shall  come  on. 
The  open  end  fittings  shall  be  completely  immersed  in  a 5 percent  solution 
(by  weight)  of  salt  water  for  not  less  than  10  seconds  and  an  alarm  shall 
nrt  occur.  The  end  fitting  shall  be  removed  from  the  salt  solution  and 
excess  solution  may  be  shaken  off.  Within  one  minute  after  removal  from 
the  -ait  solution,  the  cables  shall  be  reconnected  and  the  Reset  button 
pushed.  The  OVERHEAT  FAIL  light  shall  go  out. 

-.3  Environmental  Tests 

4.  i. I Electromagnetic  Interference 

% 

T:  e complete  system  shall  be  subjected  to  the  electromagnetic  inter- 

fercfi't:  tests  of  M1L-STD-461A  of  Category  I-C  equipment.  System  perform- 
atice  shall  be  as  required  by  that  specification. 

•♦.3.2  Htgli  Temperature 

The  complete  system  shall  be  subjected  to  a forty-eight  hour  71.1°C 
ibO'F)  storage  test.  At  the  conclusion  of  this  test  and  while  still  at 
t'  erature,  the  system  shall  be  checked  for  normal  operation  by  exposing 
the  Detector  Head  to  a saturating  source  of  ultraviolet  radiation  and  by 
ex,  Ir.g  the  Overheat  Cables  to  localized  heating.  Lights  on  the  two 
read  at  units  shall  be  observed  for  proper  operation.  Following  this,  the 
haintenance  Warning  Unit  and  Crew  Readout  Unit  shall  be  removed  from  the 
t>  ;t  ch  inber  tc  room  ambient  and  the  chamber  temperature  brought  to  82.2#C 
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(180°F)  and  held  for  a period  of  four  hours.  Ac  the  conclusion  of  his 
test  and  while  still  at  temperature,  the  system  shall  be  checked  for 
normal  operation  by  exposing  each  Detector  Head  to  a saturating  source  of 
ultraviolet  radiation  simultaneously  for  5 minutes  and  by  exposing  the 
Overheat  Cables  to  localized  heating.  Lights  on  the  Readout  Units  shall 
be  monitored  for  proper  operation.  Following  this  and  with  the  Computer 
Control  Unit  still  at  82.2°C  (180°F),  the  Overheat  Cables  shall  be  removed 
from  the  oven  and  the  calibration  test  of  paragraph  4.2.1  repeated.  The 
system  alarm  point  shall  not  vary  more  than  6 percent  from  the  reference 
alarm  temperature  of  4.2.1.  Following  this,  the  Detector  Heads  shall  be 
placed  in  a separate  oven  for  four  hours  at  260°C  (500°F)  while  the  Com- 
puter Control  Unit  is  held  at  82.2°C  (180°F)  for  the  same  period  and  the 
calibration  test,  using  the  qualified  propane  flame  of  4.2.2,  shall  be 
repeated  for  each  Detector  Head.  Also,  the  Detector  Head  shall  be  checked 
against  the  equivalent  of  5000  foot  candles  of  unfiltered  sunlight 
originating  at  an  angle  of  45°  or  less  from  the  zenith  and  shall  not  cause 
a false  alarm. 

4.3.3  ' Low  Temperature 

The  complete  system  shall  be  subjected  to  a four-hour  -40°C  (-40°F) 
storage  test.  At  the  conclusion  of  this  test  and  while  still  at  tempera- 
ture, the  system  shall  be  checked  for  normal  operation  by  exposing  each 
Detector  Head  to  a saturating  source  of  ultraviolet  radiation  and  by  ex- 
posing the  cables  to  localized  heating.  Lignts  on  the  Maintenance  Warning 
Unit  and  the  Crew  Readout  Unit  shall  be  observed  for  proper  operation. 
Following  this,  the  Overhead  Cables  shall  be  removed  from,  the  chamber  and 
shall  undergo  the  calibration  test  of  paragraph  -.2.’  with  the  Computer 
Control  Unit  still  at  -40°C.  The  system  alar  point  shall  net  vary  more 
than  6 percent  from  the  reference  alarm  temperature  of  -*.2.1  Following 
this,  with  the  Computer  Control  Unit  and  Detector  Heads  still  at  -40°C,  the 
calibration  test  using  the  qualified  calibrated  propane  flame  of  4.2.2, 
shall  be  repeated  for  each  Detector  Head.  Also,  the  Detector  Head  shall 
be  checked  against  equivalent  of  5000  foot  candles  of  unfiltered  sunlight 
originating  at  an  angle  of  45°  or  less  from  zenit  and  shall  not  cause  a 
false  alarm. 

4.3.4  Shock 

Shock  tests  shall  be  performed  on  the  system  in  accordance  with  Pro- 
cedure I of  method  516  of  MIL-STD-810B  using  a sawtooth  waveform  at  a 
level  of  20  g's  and  a duration  of  11  milliseconds.  The  test  shall  be 
performed  on  Overheat  Cables  sixty  inches  long.  Also,  the  shock  test  may 
be  performed  on  the  complete  test  system  at  one  time  or  potions  of  the 
system  may  be  tested  individually  to  accommodate  fixturing.  During  this 
test,  the  Overheat  Cables  shall  be  supported  bv  mounting  damns  spaced 
approximately  8 inches  apart.  Following  this  test,  the  system  shall  be 
checked  for  normal  operation  by  exposing  the  Detector  Heads  to  a saturat- 
ing source  of  ultraviolet  radiation  and  by  exposing  the  cables  to 
localized  heating. 
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4.3.5  Extreme  Exposure 


Or.e  Detector  Head  shall  be  subjected  to  two  repeated  exposures  at  a 
temperature  of  1093. 3°C  (2000°F)  in  an  oven  for  a period  of  1 minute  each. 
Following  this,  the  Detector  Head  shall  be  checked  in  the  system  for  normal 
operation  by  means  of  a saturating  source  of  ultraviolet  radiation.  Also, 
the  Detector  Head  shall  be  checked  against  the  equivalent  of  5000  foot 
candles  of  unfiltered  sunlight  originating  at  an  angle  of  45°  or  less  from 
the  zenith  and  shall  not  cause  a false  alarm. 

4.3.6  Altitude 

The  complete  system*  shall  be  Installed  in  an  altitude  chamber  and 
operated  at  a standby.  The  chamber  temperature  shill  then  be  reduced  to 
-40#C  (-40°F)  and  the  pressure  reduced  to  the  equivalent  of  70,000  feet 
above  sea  level.  These  conditions  shall  be  maintained  tor  one  hour.  At 
the  conclusion  of  this  time  and  while  still  at  temperature  and  pressure, 
the  system  shall  be  checked  for  normal  operation  by  means  of  a saturating 
source  of  ultraviolet  radiation  and  by  localized  heating  or  resistance  in 
parallel  with  the  Overheat  Cables.  The  chamber  shall  then  be  returned  to 
room  ambient  conditions  and  the  system  again  checked  for  normal  operation 
by  means  of  the  saturating  source  of  ultraviolet  radiation  and  by  localized 
heating  of  the  cables. 

4.4  Environmental  Tests 

4.4.1  Temperature  Shock 

The  complete  system*  shall  be  subjected  to  a temperature  shock  test 
in  accordance  with  Method  503,  Procedure  I of  MIL-STD-810B . The  temperature 
extremes  shall  be  71.1°C  (160°F)  and  -40°C  (-40°F) . At  the  conclusion  of 
this  test,  the  system  shall  be  checked  for  normal  operation  by  means  of 
ultraviolet  radiation  for  the  Detector  Heads  and  by  means  of  localized 
heating  of  the  Overheat  Cables.  Following  this,  one  Detector  Head  shall 
be  subjected  to  a temperature  shock  test  from  -53.8°C  (-65°F)  to  300°C  ( 5 7 2 0 F ) 
in  accordance  with  paragraph  4.3.4  of  MIL-D-27729A.  The  Detector  Head 
shall  be  checked  for  normal  operation  following  this  test,  by  means  of  a 
saturating  source  of  ultraviolet  radiation. 

4.4.2  Vlb  rat i on 

Vibration  tests  shall  be  performed  on  the  system  in  accordance  with 
Procedure  I,  Curve  E,  Parts  i,  2 and  3;  Time  schedule  I of  Method  514  of 
M11.-STD-81 0B.  The  test  shall  be  pert  armed  on  one  Detector  Head  rather 
than  six  and  shall  be  performed  .n  Overheat  Cables  sixty  inches  long. 

Also,  the  vibration  may  be  performed  on  the  complete  test  system  at  one 
time  or  portions  of  the  system  may  be  vibrated  individually  to  accommodate 
fixturing.  During  this  test,  the  Overheat  Cabl.s  shall  be  supported  by 
mounting  clamps  spaieJ  approximate  ly  8 ir.  ties  a, 'art.  Following  the  test. 


*The  Crew  Readout  Unit  and  the  Maintenance  Warning  I .it  need  not  be  sub- 
jected to  these  tests. 
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the  system  shall  be  checked  for  normal  operation  by  exposing  the  Detector 
Heads  to  a saturating  source  of  ultraviolet  radiation  and  by  exposing  the 
cables  to  localized  heating. 


A. 4. 3 Humidity 

The  complete  system*  with  one  Detector  Head  instead  of  six,  shall 
be  subjected  to  a humidity  test  in  accordance  with  Method  507,  Procedure  I 
of  MIL-STD-8103.  The  Crew  Readout  Unit  and  Maintenance  Warning  Unit  will 
be  subjected  to  a reduced  humidity  test  for  information  and  evaluation. 

Itnrr. ediately  after  completion  of  testing,  the  system  shall  be  checked  for 
normal  operation  by  means  of  a saturating  source  of  ultraviolet  radiation 
for  the  Detector  Head  and  localized  heating  for  the  Overheat  Cables. 

4.4.4  Salt /Fog 

The  system*  with  one  Detector  Head  instead  of  six,  shall  be  subjected 
to  a salt/fog  test  in  accordance  with  Method  509,  Procedure  I of  MIL-STD- 
810B.  Immediately  following  this  test,  the  system  shall  be  checked  for 
normal  operation  by  means  of  a saturating  source  of  ultraviolet  radiation 
for  the  Detector  Head  and  localized  heating  for  the  Overheat  Cables.  The 
system  shall  then  be  inspected  for  corrosion,  stored  for  48  hours  and 
retested  in  accordance  with  the  Method  509  requirements. 

Note:  Paragraphs  4.3.1,  4.3.4  and  4.3.6  are  to  be  done  by  an  outside 

vendor . 


*The  Crew  Readout  Unit  and  the  Maintenance  Warning  Unit  need  not  be  sub- 
jected to  these  tests. 
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1.0  OBJECT 


This  report  documents  the  qualification  test  program  performed  by 
McGraw-Edison  Electronics  Division  on  one  Integrated  Fire  and 
Overheat  Detection  System. 


SYSTEM  SN  1 


1 

Crew  Readout  Unit 

CRU 

44222 

1 

Maintenance  Warning  Unit 

MWU 

44221 

1 

Computer  Control  Unit 

ecu 

44238 

6 

Flame  Sensor  Heads 

44227 

2 Overheat  Sensor  Cables 

2.0  ADMINISTRATIVE  DATA 

Shock  & vibration  test  performed  by  Associated  Testing 
Laboratory,  Burlington,  Mass. 

Electromagnetic  interface  test:  performed  by  Sanders 

Associates,  Nashua,  N.H. 

All  remaining  tests  were  performed  at  Edison  facilities. 

3.0  APPLICABLE  DOCUMENTS 

Mil-F-7872C  Fire  & Overheat  Warning  Systems 
Mil-Std  810B  Environmental  Test  Methods 

MH-D-27729A  Smoke  and  Fire  Detection  for  Aerospace  Vehicles 
Mil-Std-704  Electrical  Aircraft  Power 
Mil-Std-461A  Electromagnetic  Interface 

General  Test  Plan  for  System  Performance  Test,  Integrated 
rire  and  Overheat  Detection  System,  Air  Force  contract 
F33615-72-C-1053. 

4.0  TESTING  PERFORMED 

The  following  tests  were  performed  in  accordance  with  the  general 
test  plan: 


TEST  PERFORMED 

SYSTEM 

PARAGRAPH 

Initial  System  Test 

1 

4.1 

Lamp  Indications 

4.1.1 

Flame  Sensor  logic 

4.1.2 

Sensor  Fault  logic 

4.1.3 

Adjacent  Head  Fault  logic 

4.1.4 

Overheat  Sensor 

4.1.5 

Initial  System  Test 

l 

4.1 

Overheat  Open  Fault  logic 

4.1.6 

Overheat  Short  Fault  logic 

4.1.7 

Power  interupt  logic 

4.1.8 

Fault  memory 

4.1.9 

155 


Performance  Test  1 4 . 2 


Overheat  Cal  4.2.1 

Detector  head  cal  4.2.2 

Detector  head  vision  4.2.3 

Detector  head  attenuation  4.2.4 

Overheat  Power  variation  4.2.5 

Overheat  Cable  response  time  815°C  (1500°F)  4.2.6 

Overheat  Cable  reset  time  4.2.7 

Overheat  Cable  partial  extinguishment  test  4.2.8 

Overheat  Cable  repeated  response  and  clearance  4.2.9 

Overheat  Cable  salt  water  immersion  test  4.2.10 

Envi ronnenta 1 lest  1 4 . 3 


Electromagnetic  Environmental  4.3.1 
High  Temp  4.3.2 
Low  Temp  4.3.3 
Shock  4.3.4 
Extreme  Exposure  Sensor  4.3.5 
Altitude  4.3.6 
Temperature  Shock  4.4.1 
Vibration  4.4.2 
Humidity  4.4.3 
Salt  Spray  4.4.4 

4 . 1 Test  Equipment 


Description  Make  Si  Model 


Power  supply  Harrison  Model  622A 

0-30  volt  DC 
5 amp 


Temp  Chamber  Thermotron  F-ll-CH-22 

37 . 7°C  (-100°F) 

176. 6°C  (+350°F) 


Hi  Temp  Chamber 
23. 8°C  (+75°F) 
1204. 9°C  (2200°F) 

Humidity  Chamber 

Salt  Spray  Chamber 

Decade  Box 

Hi  Temp  Chamber 

Flame  Pot 


Undberg  Type  51442 

Blue  M FR-256PC 
Associated  Testing  SA.80 
Leed  Northrup  4776 
GECO-Type  HCO 
Edison  per  MIL-F-7872 


Turner  Propane  Torch 
(Calibrated  propane  flame) 
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Edison  Quartz  10  Dine  tube 
(Sunlight  source) 

V diameter  stainless  steel 
gasoline  container  (open  flame) 

Stop  Watch 

Shutter 


5.0  conclusion 

One  system  perfoimed  within  the  specification  tolerances  during  and 
after  each  test  of  this  program  except  where  as  noted  in  the  results 
section.  See  appendixes  A test  plan,  B data  sheets. 

6.0  TF.S'I  PROCEDURE  AND  RESULTS 

6 . 1 Initial  Test,  Keierer.ee  Paragraph  4.1.2  of  Test  Procedure 

The  initial  test  plan  is  a confidence  check  of  system  logic  and 
sensor  operation.  A failure  was  discovered  during  test  of  paragraph 

4.1.2  when  it  wras  observed  that  the  maintenance  warning  unit,  MWU, 
did  not  exhibit  the  correct  indicator  response.  This  discrepancy 
was  related  to  an  electrical  failure  of  electronic  circuit  card 
within  the  computer  control  assembly.  Integrated  circuit  component 
UI3  failed  due  to  a solder  wisker  shorting  the  device.  This  con- 
dition was  caused  by  a workmanship  problem.  Test  was  successfully 
passed  after  replacement  of  circuit  card  assembly.  To  implement 
the  test  procedure  it  was  necessary  to  remove  the  quartz  lens 
assembly  from  the  sensor  case  to  be  able  to  cover  the  sensor  with 
a Dixie  cup. 

6 . 2 Performance  Test,  Reference  Test  Procedure  Paragraph  4,2 

Overheat  cable  response  times  were  measured  using  a flame  pot  con- 
figured to  Mil-F-7872C.  Flame  sensor  response  times  were  measured 
using  a flame  source  defined  by  Mil-D-27729A  in  conjunction  with  a 
shutter  arrangement  to  supply  a sync  pulse  to  an  oscilloscope  for 
measuring  response  time. 

6 . 3 Environmental  Test  Reference  Test  Procedure  Paragraph  4,3 

6.3.1  Electromagnetic  Environment  Ref  TP  4.3.1 


This  test  was  conducted  by  Sanders  Associates;  see  Appendixes  C for 
test  report.  Maximum  limits  were  exceeded  in  the  following  test: 

CEO-3  Broadband,  28  volt  return  lead 
280  KHZ  to  1.5  MHZ 

CF.0-3  Narrow  band,  28  volt  return  lead 
260  KHZ,  560  KHZ,  850  KHZ 
CE0-3  Transient  28  volt  return  800  KHZ 
CE0-3  Transient  28  volt  positive  lead  25  MHZ 
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KEO-2  Broadband  radiation  .014  MHZ  .020  MHZ  and  .031  MHZ 
REO-2  Narrow  band  radiation  25  MHZ 
125  MHZ  254  MHZ  284  MHZ 
REO-2  Transient  25  MHZ 

The  following  tests  were  satisfactorily  passed:  RS03,  RS02,  CS06, 

CS02,  CS01. 

t>.3.2  High  Temp  Storage,  Reference  TP  4.3.2 

High  temp  storage  was  successfully  completed  after  an  initial  pro- 
blem was  encountered  with  four  flame  sensor  heads  as  the  sensor 
tubes  became  fogged  due  to  residue  deposit  formed  from  outgassing 
of  the  potting  compound.  This  residue  attenuated  the  UV  Signal  from 
the  source  lamps  to  the  sensor  tube  resulting  in  self-test  failure. 

A fifth  flame  sensor  failed  due  to  an  element  within  the  UV  tube 
that  separated  due  to  probable  temperature  stress  on  an  imperfection 
of  the  element  itself.  The  weld  of  the  element  itself  remained 
secure  and  was  not  at  fault.  Probable  cause  of  element  imperfection 
may  have  been  related  to  stress  during  welding  operation.  All  of 
the  flame  sensors  were  reworked  and  properly  cured,  the  unit  with 
the  defective  tube  was  replaced  and  all  of  the  flame  sensors  were 
re-tested  and  passed. 

6.3.3  Extreme  Exposure  Reference  TP  4.3.5 

Flame  sensor  #5  was  placed  in  1093. 3°C  (2000°F)  oven  for  60  seconds; 
after  approximately  35  seconds  the  potting  around  the  quartz  glass 
lens  ignited.  At  the  end  of  the  period  the  unit  was  removed  and 
fire  extinguished  by  smothering  the  flame.  The  flame  sensor  was 
connected  to  the  CCU  for  the  functional  test.  The  Quartz  lens  was 
observed  to  have  a slight  residue  coating.  The  flame  sensor  was  de- 
energized and  placed  again  in  the  oven  for  the  second  one-minute 
exposure.  After  20  seconds  the  potting  compound  re-ignited  and  at 
30  seconds  the  flame  sensor  cable  ignited.  After  removal  from  the 
oven  the  flames  were  smothered  and  the  unit  tested.  The  flame  sen- 
sor failed  the  first  self  test  but  upon  reseting  system  reset  normal 
operation  was  obtained.  Although  this  time  the  quartz  lens  was 
heavily  coated,  it  would  still  respond  to  open  flame.  Examination 
also  showed  that  sensor  tubes  and  source  lamp  were  coated  heavily 
from  residue. 

6.3.4  Vibration  Test  Reference  Paragraph  4.4.2  of  the  TP 

The  test  was  conducted  by  Associated  Testing  Laboratory  of  Burling- 
ton, Mass.  The  vibration  test  was  performed  in  accordance  with 
paragraph  4.4.2  of  the  procedure.  No  problems  were  encountered  with 
the  sensor  head  or  overheat  cable.  Initial  problems  were  encountered 
with  the  CCU,  MWU  and  CRU  assemblies.  Vibration  and  shock  were 
successfully  passed  after  incorporating  external  Barry  shock  iso- 
lators to  all  three  units.  The  C.R.U.  and  C.C.U.  also  had  several 
mechanical  changes  as  a result  of  initial  surveys  which  indicated 
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that  mechanical  strengthening  would  be  necessary.  The  following  is 
a summary  of  modifications  made  on  the  CRU: 

1.  Lamp  regulator  printed  board  open  PC  run — replaced  with 

jumper  wire — probable  cause:  defective  etch  covered  by 

solder  bridge. 

2.  Relay  logic  Board 

Wire  jumper  open,  secured  with  RTV 

3.  Harness  Cable,  broken  wires  resoldered  and  secured. 

The  following  modifications  were  made  on  the  C.C.U.: 

1.  Capacitor  on  C/I  board  broke  off — used  Augot  clamps  instead 
of  cable  ties.  Added  buss  jumpers  to  strengthen  PC  etch. 

2.  Transient  suppressor — strengthen  mounting  by  using  heavier 
hardware . 

3.  Reconfigure  mounting  on  filter  choke.  Add  ribs  to  side  wall 
to  dampen  resonances. 

4.  Add  additional  tie-downs  to  resistors  on  transient  suppressor. 
No  modifications  were  made  on  the  M.W.U. 

6.3.5  Humidity  Test  Ref.  TP  4,4.3 

After  removal  of  the  system  from  the  chamber  the  unit  was  turned  on 
and  was  not  functional  due  to  a failure  of  the  transient  suppressor 
assembly  in  the  CCU.  The  failure  was  electrical  and  not  directly 
related  to  the  humidity  test.  Cause  of  the  failure  was  related  to 
insufficient  thickness  of  insulator  bushings  under  zener  diodes  and 
tendency  for  diodes  to  creep  causing  them  to  short.  One  of  the 
diodes  had  a cracked  seal  at  the  time  of  replacement. 

There  also  appeared  to  be  corrosion  on  the  shield  box  for  the  R.F.I. 
filters  which  is  cadmium  plated.  The  "hair"  observed  is  due  probably 
to  the  fact  that  the  choice  of  cadmium  in  a non-vent i lated  box  was 
in  the  presence  of  RTV  and  other  organic  electrical  substances. 
Cadmium  is  not  recommended  in  QQ-P-416  this  application  and  should 
be  changed  to  tin  plate  per  Mil-T-10727. 

6.3.6  Salt  Spray  Test  Ref.  TP  4.4.4 

Upon  removal  of  Flame  Sensor  Head  44227  from  the  chamber  the  unit 
was  tested  and  found  to  be  non-operational . The  fault  was  traced 
to  a cracked  UV  tube  and  not  related  to  salt  spray.  The  tube  failure 
was  probably  related  to  handling  of  the  Flame  Sensor  assembly  unit 
but  cannot  be  confirmed.  Examination  of  the  Flame  Sensor  did  not 
reveal  any  signs  of  salt  water  corrosion. 
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A Note  on  System  #2 


During  a reliability  test  on  System  //2,  the  FIRE  warning  light  came 
on  for  one  second  when  no  fire  was  present.  Various  considerations 
suggested  this  false  alarm  originated  in  U/V  Detector  Head  Oil. 

This  head  was  changed  to  another  input  channel  and  testing  resumed. 

About  30  hours  later,  a second  false  FIRE  warning  occurred,  this 
one  apparently  due  to  a power-line  abnormality.  In  over  200  hours 
of  further  testing,  no  further  false  FIRE  warnings  have  occurred. 
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DATA  SHEETS 
FOR  USE  WITH 
"GENERAL  TEST  PLAN 
FOR 

SYSTEM  PERFORMANCE  TESTS 
INTEGRATED  FIRE  AND  OVERHEAT  DETECTION  SYSTEM" 
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System  if 


2/23/76 


Initials 


Test  Satisfactory 
. Yes , No 


4.1.1 


4.1.2 


All  lights  out 

Lamp  test  - CRU 

Lamp  test  - MWU 


"Fire"  warning  from  head  #1 

"Fire"  warning  from  head  #2 

"Fire"  warning  from  head  #3 

"Fire"  warning  from  head  #4 

"Fire"  warning  from  head  #5 

"Fire"  warning  from  head  #6 

Sensor  1 shielded.  Sensor  2 exposed 
Sensor  2 shielded,  Sensor  1 exposed 
Sensor  1 shielded.  Sensor  2 exposed 
Sensor  2 shielded.  Sensor  1 exposed 
Sensor  1 shielded.  Sensor  2 exposed 
Sensor  2 shielded,  Sensor  1 exposed 
Sensor  lsshielded.  Sensor  2 exposed 
Sensor  2 shielded.  Sensor  1 exposed 
Sensor  1 shielded.  Sensor  2 exposed 
Sensor  2 shielded.  Sensor  1 exposed 
Sensor  1 shielded,  Sensor  2 exposed 
Sensor  2 shielded.  Sensor  1 exposed 


head  //I _ 

head  //I _ 

head  112 _ 

head  if 2 _ 

head  0 3 _ 

head  #3 _ 

head  ifU _ 

head  #4 _ 

head  if  5 _ 

head  if 5 _ 

head  it 6 _ 

head  If6 


4.1.3  Test  source  shielded  - head  it  1 

Test  source  shielded.  Tubes  exposed  - head  #1- 

Head  #1  source  shielded,  head  #2  exposed 

Head  if  1 source  shielded,  head  if 6 exposed 

Reset  Button  Pressed 

Test  source  shielded  - head  if 2 

Test  source  shielded,  tubes  exposed  - head  if 2- 

Head  if 2 source  shielded,  head  if 3 exposed 

Head  if 2 source  shielded,  head  #1  exposed 

Reset  Button  Pressed 

Test  source  shielded  - head  if 3 

Test  source  shielded,  tubes  exposed  - head  if 3- 

Head  if 3 source  shielded,  head  If 4 exposed 

Head  If 3 source  shielded,  head  If 2 exposed 

Reset  Button  Pressed 

Test  source  shielded  - head  ifb 

Test  source  shielded,  tubes  exposed  - head  //4- 

Head  If 4 source  shielded,  head  if 5 exposed 

Head  #4  source  shielded,  head  If 3 exposed 

Reset  Button  Pressed 
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System  It  l Date  2/23/76 Initials 


4.1.3  (Continued) 


Test  source  shielded  - head  II 5 

Test  source  shielded,  tubes  exposed  - head  It 5 

Head  115  source  shielded,  head  II 6 exposed 

Head  II 5 source  shielded,  head  II 4 exposed 

Reset  Button  Pressed 

Test  source  shielded  - head  II 6 

Test  source  shielded,  tubes  exposed  - head  II 6 

Head  II 6 source  shielded,  head  II 1 exposed 

Head  II 6 source  shielded,  head  #5  exposed 

Reset  Button  Pressed 


Source  shielded  in  heads  III  4 //2 

Shields  removed 

Heads  II 3,  #4,  II 5 & II 6 exposed 

Sources  shielded  on  eads  #2  6 II 3 

Shields  removed 

Heads  #1,  III*,  //5  & II 6 exposed 

Sources  shielded  in  heads  #3  6 #4 

Shields  removed 

Heads  #1,  II 2,  II 5,  & II 6 exposed 

Sources  shielded  in  heads  III*  6 #5 

Shields  removed 

Heads  #1,  II 2,  #3  6 II 6 exposed 

Sources  shielded  in  heads  //5  & #6 

Shields  removed 

Heads  #1,  #2,  II 3,  4 #4  exposed 

Sources  shielded  in  heads  4 #1 

Shields  removed 

Heads  II 2,  #3,  #4,  4 //5  exposed 


Cables  A and  B heated 

Cable  A disconnected,  both  cables  heated 

Cable  A reconnected,  Cable  B disconnected.  Reset 

Cables  A and  B heated- 

Cable  B reconnected,  reset  button  pushed 

Cables  A and  B heated 
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Test  Satisfactory 


Yes  . No 


— 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

J 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

✓ 

/ 

/ 

/ 

■ “ / 

V 

/ 

1 


Date  2/23/76,  3/9/76 


System  II 


Initials 


Test  Satisfactory 


4.1.6 

Cables  A and  B disconnected  at  J12,  J14 

Cables  A and  B heated 

Cables  A and  B reconnected,  reset  button  pushed 

4.1.7 

Cable  A disconnected  at  J12  and  shorted 

Cable  B disconnected  at  J14  and  shorted 

Cables  A and  B reconnected,  reset  button  pushed 

4.1.8 

Power  to  Computer  Control  Unit  turned  off 

4.1.9 

Head  #1,  Cable  A disconnected 

Power  reapplied  after  three  (3)  hours 

4.2.1 

Measured  alarm  temperature  406. 1°C  (763°F) 

4.2.2 

Input  Power  - 24  volts 


* 

"Fire"  on  within  .5  second 
One-half  of  flame  blocked 
"Fire"  on  within  1.5  seconds 


Input  Power  = 30  volts 


* 

"Fire"  on  within  .5  second 
One-half  of  flame  blocked 
"Fire"  out  within  1.5  seconds 


Head 

#1 

Head 

n 

Head 

in 

Head 
II 4 

Head 
II 5 

Head 

lie 

Test  Sati 

sf actory? 

nn 

nn 

mum 

nn 

nn 

nn 

mm 

mm 

U!» 

lZjMH 

mm 

mm 

E» 

V\ 

71 

/! 

J ! 

1 ! 

/ 1 

/ 1 

/ ! 

/ ! 

Head 

111 

Head 

113 

Head 

H 

Head 
II 5 

Head 

116 

Test  Sati 

sf actor 

y? 

DQ 

DO 

DO 

DEI 

DEI 

no 

mm 

E» 

ESD 

mm 

mm 

Hi 

mam 

mum 

Ti 

^1 

IZTT 

/! 

/! 

-Ja 

Yes  No 


/ 

✓ 

/ 

/ 

/ 

/ 

/ 

/ 

^ 

* Y = Yes,  N = No 
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System  0 


1 


Date  3/10/76 


Initials 


4.2.2  (Continued) 


Input  Power  = 18  volts 


"Fire"  on  within  .5  second 
One-half  of  flame  blocked 
"Fire"  out  within  1.5  seconds 


Head 

#1 

Head 

#2 

Head 
//  3 

Head 

//4 

Head 

Head 

#6 

Test  Satisfactory? 

Y | N 

Y ! N 

Y | N 

Y ! N 

Y ' N 

Y ! N 

/ i 

/ ! 

/ ! 

/! 

/ ! 

/ ! 

J 1 

/ ! 

/ 1 

/ 1 

/ ! 

/ 1 

/ ! 

/ 1 

J 1 

/ I 

/ ! 

/ I 

4.2.3 

Horizontal  planes  - 40°  off  center 


"Fire"  on  within  .5  second 
One-half  of  flame  blocked 


Vertical  planes  - 40°  off  center 


System  It 


1 


Date  3/11/76 


Initials 


A. 2. 5 


Input  Power  = 2A  volts 


Alarm 

time : 

6 

(3) 

Clear 

time : 

7 

Input 

Power 

o 

CO 

n 

volts 

Alarm 

time : 

6 

(3) 

Clear 

time : 

7 

Input 

Power 

= 18 

volts 

Alarm 

time : 

6 

(3) 

Clear 

time : 

7 

A. 2. 6 

Alarm  time:  8 Sec. 


A. 2. 7 


Alarm  time  after  reapplied  flame: 


3 Sec . 


A. 2. 8 

Is  50%  masking  test  satisfactory? 
Clear  time  after  flame  removal 


Yes 

A Sec. 


Alarm  times: 
Clear  times: 


7 (A)  A A sec. 

7 7 7 sec. 


A. 2. 10 


Cables  disconnected 
End  fittings  immersed 

Cables  reconnected,  reset  button  pushed 


Test  Satisfactory? 
Yes  No 


/ 

/ 

~7~ 
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System  it 


1 


Date 


3/17/76 


Initials 


4.3.1 


4.3.2 


Electromagnetic  interference  tests 


Entire  system  at  71.1°C  (160°F) 


Response 

Response 

Response 

Response 

Response 

Response 


to  ultraviolet  - Head  #1- 
to  ultraviolet  - Head  #2 
to  ultraviolet  - Head  #3 
to  ultraviolet  - Head  #4 
to  ultraviolet  - Head  if5 
to  ultraviolet  - Head  #6 


Response  to  overheat  condition- 


CCU,  heads  and  cables  at  82.2°C  (180°?) 


Response 

Response 

Response 

Response 

Response 

Response 


to  ultraviolet  - Head  #1 
to  ultraviolet  - Head  #2 
to  ultraviolet  - Head  # 3 
to  ultraviolet  - Head  #4 
to  ultraviolet  - Head  #5 
to  ultraviolet  - Head  #6 


Response  to  overheat  condition- 


Tests  Satisfactory? 


Yes  No 


See 

Report 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

/ 

./ 

/ 

y 

j 

/ 

r 

L 

Measured  alarm  temperature  392.2°C  (738°F) 


Detector  Heads  at  260°C  (500°F) 
3/22/76 


* 


"Fire"  on  within  .5  second 
One-half  of  flame  blocked 
"Fire"  out  within  1.5  seconds 


Is  false  alarm  test  satisfactory?  Yes 


Head 

Head 

Head 

Head 

Head 

Head 

#1 

in 

#4 

#5 

ii  6 

Test  Satisfactory? 

y In 

Y In 

y In 

y In 

y In 

Y In 

/ ! 

/ ! 

/ i 

/ | 

/ ! 

/ ! 

/ 1 

/ ! 

J i 

/ i 

/ ! 

1 \ 

/ ! 

J-l—i 

/ 1 

/ , j 

/ i 

* Y - Yes,  N - No 
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System  If 


Date  3/23/76 


Initials 


4.3.3 


Response 

to 

ultraviolet  - 

Head 

II 1- 

Response 

to 

ultraviolet  - 

Head 

02- 

Response 

to 

ultraviolet  - 

Head 

03- 

Response 

to 

ultraviolet  - 

Head 

04- 

Response 

to 

ultraviolet  - 

Head 

05- 

Response 

to 

ultraviolet  - 

Head 

06- 

Response 

to 

overheat  condition- 

Test  Satisfactory? 
Yes  No 


/ 

/ 

/ 

/ 

V 

/ 

/ 

Measured  alarm  temperature  404. 4°C  (760°F) 


"Fire"  on  within  .5  second 
One-half  of  flame  blocked 
"Fire"  out  within  1.5  seconds 


Head 

Head 

Head 

Head 

Head 

Head 

01 

02 

03 

04 

05 

06 

Test  Satisfactory? 

at a 

Ofl 

D 

o 
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DQ 

m 

m 

H 

■ 

HH 

m 

Hi: 

km 

lU 

n 

n 

m 

RM 

I 

J 

RM 

KM 

n 

■1 

km 

W 

1 

1 

Is  false  alarm  test  satisfactory? 


Yes 


4.3.5 


Response 

to 

ultraviole  t 

- Head 

in 

Response 

to 

ultraviolet 

- Head 

a 2 

Response 

to 

ultraviolet 

- Head 

03 

Response 

to 

ultraviolet 

- Head 

//  4 

Response 

to 

ultraviolet 

- Head 

05 

Response 

Response 

to 

to 

ultraviolet 
overheat  cor 

- Head 
idi tion- 

it6 

Response  to  ultraviolet  radiation- 
False  alarm  test 


Test  Satisfactory? 
Yes  No 


/ 

/ 

/ 

/ 

/ 

J 

OK 

/ 

OK 

* Y = Yes,  N 


No 
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System 


Date  4/29/76 


Initials 


-40°C , 70000  ft. 


Response 

Response 

Response 

Response 

Response 

Response 


to  ultraviolet 
to  ultraviolet 
to  ultraviolet 
to  ultraviolet 
to  ultraviolet 
to  ultraviolet 


Head  01- 
Head  02- 
Head  03- 
Head  04- 
Head  05- 
Head  06- 


Response  to  overheat  condi tion- 


Room  temperature,  pressure 


Response 

to 

ultraviolet  - 

Head 

01— 

Response 

to 

ultraviolet  - 

Head 

#2— 

Response 

to 

ultraviolet  - 

Head 

03- 

Response 

to 

ultraviolet  - 

Head 

04— 

Response 

to 

ultraviolet  - 

Head 

#5— 

Response 

to 

ultraviolet  - 

Head 

06— 

Response 

to 

overheat  condition- 

Test  Satisfactory? 
Yes  No 


Response 

Response 

Response 

Response 

Response 

Response 


to  ultraviolet 
to  ultraviolet 
to  ultraviolet 
to  ultraviolet 
to  ultraviolet 
to  ultraviolet 


Head  01- 
Head  02- 
Head  03- 
Head  04- 
Head  05- 
Head  06- 


Response  to  overheat  condition- 


✓ 

T 


/ 

T 


OK 


After  -40°C  (~40°F) / 7 1 . 1°C  (160°F)  Temperature  shock 


/ 


After  -53. 8°C  (-65°F) / 300°C  (572°F)  detector  head  shock 

/ 


Response  to  ultraviolet  exposure 


169 


System  //  1 Date  A/29/76 Initials 


Test  Satisfactory? 
Yes  No 


A. 4. 2 Post  Vibration 

/ 

/ 

~~r 

j 

Response  to  ultraviolet  - Head  #5 

1 

/ 

/ 

4.4.3 

/ 

A.  A.  A 

Response  to  ultraviolet,  overheat  immediately 

/ 

Response  to  ultraviolet , overheat  after  48  hours 

/ 

Administrative  Data 


1 .0  Purpose  of  Test: 

To  determine  the  ability  of  the  submitted  Integrated  Fire  and 
Overheat  Protection  System  to  comply  with  the  requirements  of 
the  test  specified  in  tne  Procedures  of  this  report. 


2.0  Manufacturer: 


Edison  Electronics  Division 
McGluw  Ec ison  Company 
Grenier  c ield 

Manchester,  New  Hampshire  03103 


3.0  Manufacturer's  Type  or  Model  No  : 


4.0  Drawing,  Specification  or  Exhibit: 


5.0  Quantity  of  Items  Tested: 


6.0  Security  Classification  of  Items: 


Edison  Electronics  General 
Test  Plan,  Dated  May  15,  1972, 
revised  Report  Number  59377-1, 
June  10,  1975  and  December  11, 
1975. 

One  (!)  System 
Unclassified 


7.0  Date  Test  Completed: 


May  11,  1976 


8.0  Test  Conducted  By:  Associated  Testing  Laboratories,  Inc. 

9.0  Disposition  of  Specimens:  Returned  to  Edison  Electronics  Division 

" Of  McGraw-Edison  Company. 

10.0  Abstract: 

The  submitted  Integrated  Fire  and  Overheat  Protection  System  was 
subjected  to  Environmental  Testing  in  accordance  with  the  above 
procedures.  The  System  successfully  completed  the  Environmental 
Test  specified. 
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GENERAL  INFORMATION 


The  Vibration  and  Shock  Tests  were  performed  on  the 
following: 

One  (1)  - C R U (Crew  Readout  Unit). 

One  (1)  -CCU  (Computer  Control  Unit). 

One  (1)  - Detector  Head. 

One  (1)  - Heat  Detector  Cable. 

One  (1)  - M W U (Maintenance  Warning  Unit). 

The  Altitude  Test  was  performed  on  the  entire  system 
consisting  of  the  following: 

One  (1)  - C R U (Crew  Readout  Unit). 

One  (1)  -CCU  (Computer  Control  Unit). 

One  (1)  - M W U (Maintenance  Warning  Unit). 

Six  (6)  - Ultraviolet  Detector  Heads 
One  (1)  - Dual  Overheat  Cable  Loop 
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ALTITUDE  TEST 


TEST  PROCEDURE 

The  Complete  System  was  subjected  to  an  Altitude  Test  in  accor- 
dance with  Edison  Electronics  General  Test  Plan  as  follows: 

The  System  was  placed  within  an  Altitude  Chamber  which  was  then 
sealed.  A functional  check  was  then  performed  at  a standby. 

The  Chamber  temperature  was  decreased  to  -40°F  and  stabilized 
for  one  hour.  The  internal  pressure  was  simultaneously  re- 
duced to  simulate  an  altitude  of  70,000  feet  (33.59mm). 

Following  one  hour  of  stabilization,  and  while  still  at  the 
required  test  parameters,  an  operational  check  was  performed. 
The  pressure  and  temperature  were  then  reduced  gradually  to 
room  ambient  and  the  system  was  again  checked  for  normal 
operation. 


TEST  RESULTS 

There  was  no  evidence  of  any  physical  damage  following  the 
test.  The  System  functioned  satisfactorily  during  and  follow- 
ing the  exposure  as  reported  by  a representative  of  Edison 
Electronics . 
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VIBRATION  TEST 


TEST  PROCEDURE 

The  individual  system  components  as  listed  in  the  Abstract 
were  subjected  to  a Sinusoidal  Vibration  Test  in  accordance 
with  MIL-STD-810B , Procedure  I,  Curve  Z,  Parts  1,  2,  and  3 
and  Time  Schedule  I.  The  following  is  a description  of  the 
test  as  it  was  performed. 

The  System  Components  were  individually  mounted  to  vibration 
test  fixtures.  The  test  fixture  was  then  securely  attached 
to  the  table  of  a vibration  exciter.  A control  accelerometer 
for  monitoring  and  controlling  the  input  vibration  amplitude 
was  mounted  on  the  test  fixture  near  the  specimen  mounting 
points.  A monitor  accelerometer  was  utilized  in  conjunction 
with  an  "X-Y"  plotter  to  determine  the  presence  of  resonant 
frequencies . 

The  System  Components  were  then  subjected  to  a Vibration  Test. 
The  Vibration  Test  was  performed  at  room  ambient  temperature. 

A resonance  survey  of  the  Components  along  each  orthogonal 
axis  was  made.  The  frequency  range  from  5 to  500  Hz  was  per- 
formed at  reduced  levels. 

During  the  frequency  sweep  from  5 to  500  Hz,  the  output  of  the 
monitor  accelerometer  probe  was  monitored  in  order  to  determine 
the  presence  of  resonant  frequencies.  A resonant  frequency 
was  defined  as  a frequency  at  which  the  ratio  of  the  output 
of  the  monitor  accelerometer  to  the  input  vibration  amplitude 
was  2 or  greater.  Each  resonance  was  recorded. 

Each  component  was  then  subjected  to  Sinusoidal  Vibration 
along  the  same  orthogonal  axis  over  the  frequency  range  of  5 
to  500  Hz.  The  range  from  5 to  500  Hz  and  back  to  5 Hz  was 
traversed  at  a logarithmic  rate  in  approximately  15  minutes 
(0.26  decades/minute 1 . The  input  vibration  amplitudes  are 
given  below: 


Report  No T-3884-11  Page i. 


Associated  Testing  Laboratories,  Inc. 

Clifton,  New  Jersey  07012 
Burlington,  Mossachusetts  01803 


176 


VIBRATION  TEST 


TEST  PROCEDURE  (continued) 


Frequency 


Input  Vibration  Amplitude 


5-14 
14  - 23 
23  - 90 
90  - 500 


0.1  inch  d.a. 

±lg 

0.036  inch  d.a. 
±15g's 


The  total  cycling  time  was  determined  from  the  table  given 
below: 


Number  of 
Resonances 


CYCLING  AND  DWELL  APPORTIONMENT 


Total  Dwell 
Time  in  Min- 
utes at  Res- 
onant Points 


30  60 


90  120 


Total  Cycling 
Time  in  Min- 


90  60 


The  Components  were  vibrated  along  the  same  orthogonal  axis 
at  the  resonant  frequencies  which  were  determined  during  the 
resonance  survey.  Vibration  was  for  30  minutes  at  each  resonant 
point.  If  more  than  four  resonant  points  were  noted  from  the 
resonant  survey,  only  the  four  most  severe  were  used  for 
resonance  vibration. 

The  above  procedure  was  performed  in  each  of  the  Components 
three  orthogonal  axes.  At  the  conclusion  of  vibration  in  each 
axis,  each  unit  was  examined  for  any  signs  of  damage. 
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VIBRATION  TEST 

TEST  RESULTS 

Each  individual  System  Component  tested  successfully  completed 
3 hours  of  vibration  per  axis  with  no  physical  damage. 

Refer  to  Appendix  for  resonant  search  data. 
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SHOCK  TEST 


TEST  PROCEDURE 

The  Individual  System  Components  were  subjected  to  a shock  test  in 
accordance  with  Edison  Electronics  General  Test  Plan,  as  follows: 

The  units  were  individually  mounted  to  the  shock  machine.  The  shock 
machine  was  previously  calibrated  to  produce  a shock  pulse  of  20g 
peak  amplitude  and  11  milliseconds  time  duration.  The  shock  pulse 
wave  form  approximated  that  of  a sawtooth.  Each  component  was  sub- 
jected to  a total  of  18  blows,  three  in  each  direction  of  three 
mutually  perpendicular  axes. 

Following  the  test,  the  units  were  removed  from  the  fixture  and 
examined  for  damage.  The  System  was  then  checked  for  normal  operation. 


TEST  RESULTS 

The  System  Components  all  satisfactorily  completed  the  shock  test 
with  no  physical  damage  noted.  The  System  operated  satisfactorily 
following  the  test  as  reported  by  the  Edison  Electronics  representative. 
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SINUSOIDAL  VIBRATION  ANALYSIS 
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ELECTROMAGNETIC  INTERFERENCE  REPORT  TEST  SUMMARY  SHEET 


TEST  ITEM:  REPORT  NO.  DATE  TEST  COMPL.  5/7/76 

ONE  I.F.O.  SN  1 2439  

DATE  REPT.  COMPL. 


MC  GRAW  EDISON 


TEST 

METHOD 


CE03 


CS02 


RSO  3 


MIL-STD-461A  Notice  3 


SUMMARY  OF  TEST  RESULTS 


20  KHz  to  50  MHz,  Power 
Leads 

30Hz  to  50KHz,  Power 
Leads 

50KHz  to  400MHz,  Power 
Leads 

Spike,  Power  Leads 

9 . 5 KHz  to  10GHz 

Magnetic  Induction  Field 

14KHz  to  10GHz  Electric 
Field 


SUMMARY  OF  REPORT:  CE03:  Worst  case  Bb  emission  exceeds  limit  by 

32dB.  Worst  case  NB  emission  exceeds  limit  by  26dB.  RE02:  Worst 

case  BB  emission  exceeds  limit  by  1 2 d B . Worst  case  NB  emission  exceeds 
limit  by  21 dB . 
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1.0  administrative:  data 

1 . 1 Purpose/Reason  for  Test 

To  determine  if  McGraw-Edi son , IFO  Equipment  complies  with 
the  requirements  of  M I L - STD-46 1 A , Notice  3,  for  Class  1A  equipment. 

1 . 2 Description  of  Test  Sample 

The  IFO  equipment  tested  consisted  of  the  following  units: 

Crew  Read-out  Unit 
Maintenance  Warning  Unit 
C.C.U. 

6 ea  U.V.  Detectors  (Flame  Sensors) 

1 . 3 Disposition  of  Test  Sample 

Equipment  was  returned  by  McGraw  Edison  by  their  representative 

1.4  Re  fe  rences 


M I L -STD-46  1 A,  Notice  3 


Electronics  Interference 
Characteristics  Requirements 
for  Equipment. 


MIL-STD-462,  Notice  2 


Electromagnetic  Interference 
Characteristics,  Measurement  of 
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FACTUAL  DATA 


Revision 


2.0  GENERAL 

2.1  1 . Accuracy  of  Measurements 

2.1.1  Field  Intensity  Meters 

The  principle  means  of  determining  frequency  and  amplitude 
during  the  test  was  one  or  more  of  the  following  field  intensity 
meters : 


Check 


If  Used 

Model  No 

Mf  r . 

□ 

EMC- 1 0 
Calibrated 

Fairchild 

every 

EMC  - 2 5 
Cal i bra  ted 

Fairchild 

every 

□ 

EMA-91 0 
Cal  ibrated 

Singer/ Empi re 
every 

□ 

NF-105 
Basic  Unit 

Si nger/Empi re 

□ 

TX  - 12 

Months  1 ' T TA  - 1 2 

CD 

T 2 - 12 

Months  CD  T3  - 1 2 

F requency 
Range 

Frequency 
A c c u r a c y 

Ampl i tude 
Accuracy 

20Hz- 50kHz 
months 

+ 0/2%  + 5Hz ) 

+1/2  dB 

1 4kHz- 1 GHz 
12  months 

+ 2% 

+1.5  dB 

1 GHz-26 . 5GHz 
12  months 

+ 1/2% 

+ 2 dB 

1 4kHz- 1 GHz 
12  months 

+ 2% 

+ 1 dB 

Months  □ T 1 

1 2 Months 

Months 

These  instruments  were  calibrated  by  the  Sanders  Associates 
Instrumentation  Ca 1 i bra t i on/ S t a nd a rd s Laboratory,  which  operates 
a government  approved  calibration  program  in  accordance  with 
M I L -C-4  5662A , "Calibration  System  Requirements".  The  calibrating 
equipment  accuracy  required  by  MIL-C-45662A  is  several  orders  of 
magnitude  greater  than  that  of  the  EMC  instrumentation  listed  above. 
This  ensures  the  greatest  possible  frequency  and  amplitude  data 
accuracy. 

2 . 2 T ransducers 

All  antennas-- (wi th  one  except i on )-- and  current  probes  use 
the  correction  factors  supplied  by  their  respective  manufacturers. 
The  single  exception  is  the  Empire  V A - 1 05  41- inch  vertical  rod 
antenna  (150kHz  to  30 MHz)  which  is  calibrated  every  six  months  by 
the  Sanders'  Calibration  Laboratory. 

2 . 3 Signal  Sources 

A variety  of  signal  sources  were  used  to  develop  the  r.f. 
environment  for  system  susceptibility  tests,.  The  field  intensity 
was  monitored  by  the  field  intensity  meters  described  above,  and  so 
the  signal  source  was  not  a primary  con s i d er a t i o n in  determing  the 
accuracy  of  measurement. 

The  signal  sources  are  calibrated  by  the  S/A  Instrument 
Ca  1 i b r a t i on/ S tanda r d s Laboratory  on  a 12  month  cycle. 
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2 . 4 Description  of  Shielded  E n c 1 o 

a)  Type  Construction: 

b)  Manufacturer: 

c)  Model  No: 

d ) Size: 

e)  Door  Clerance: 

f)  Filter  Current  & 

Voltage  Rating: 

g ) Ground  PI ane 
Size  & Material: 

h)  DC  Bonding 
Resistance  of  Ground 
Plane: 

2 . 5 Test  Sample  Operation 


Per  MIL-E-8881  ; Type  1 1 B per 
Table  I;  Double  shield  cell 
type,  solid  metal.  Class  C 
per  Table  II. 

RayProof  Corporation,  Norwalk, 
Conn . 

81 

6. 1M  x 3M  x 2.4M 

2M  x 1.8M 

RayProof  1B41-60 
60  amp,  115V  AC,  400  Hz 

Copper  .92M  x 3.4M  x 79MM  thick 
.2  mi  1 1 i ohms 


For  all  EMI  tests  the  IfO  was  placed  into  normal  operation. 
None  of  the  test  light  indicators  were  lit. 


2 . 6  Susceptibility  Monitor j n g 

During  susceptibility  testing,  the  test  lie1  . were  monitored 
to  check  for  any  malfunction. 
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APPENDIX  A 
TEST  METHOD  CE03 
CONDUCTED  EMISSION 
POWER  LEADS 
20KHz  to  50MHz 
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TEST  EQUIPMENT 


DESCRIPTION 

MODEL/MFG. 

SERIAL  NO. 

CAL. DATE 

EMI  METER 

NF-105 

EMPIRE 

3348 

7/75 

CURRENT  PROBE 

91550-1 

STODDART 

BF496 

N/A 

CAPACITORS 

lOufd  FEEDTHRU 
SANDERS  ASSOCIATES 

N/A 

N/A 

TEST  PROCEDURE 

Broadband 

and  narrowband  conducted  emissions  were  measured  from 

20  KH  z to  50MHz, 

on  the  28VDC  power  leads.  The 

test  setup 

is  shown 

in  Figure  I . 

TEST  RESULTS 

Broadband  conducted  emissions  exceeding  CE03  limits  were 
measured  on  +28  volt  and  return  leads.  Worst  case  conducted  emission 
exceeds  the  limit  by  3 2 d B on  28V  return  lead.  Narrowband  conducted 
emission  exceeding  CE03  limits  were  measured  on  28V  return  lead. 

Worst  case  conducted  emission  exceeds  limits  by  26dB.  Transients 
exceeding  CE03  limits  were  measured  on  +28V  and  return  leads.  Worst 
case  exceeds  limits  by  2 5 d B . See  data  sheets  1 thru  6. 
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APPENDIX  B 
TEST  METHOD  CS01 
CONDUCTED  SUSCEPTIBILITY 
POWER  LEADS 
30Hz  to  5 OKHz 
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TEST  EQUIPMENT 


DESCRIPTION 

MODEL/ MFG 

SERIAL  NO. 

CAL. DAT 

OSCILLATOR 

200CD  HEWLETT- 
PACKARD 

333-54618 

N/A 

POWER  AMPLIFIER 

M0100  BOGEN 

J -52 

N/A 

TRANSFORMER 

6220-1  SOLAR 

N/A 

N/A 

VOLTMETER 

6 30 PL  TRIPLETT 

4593 

10/75 

TEST  PROCEDURE 

A 3 V RMS  signal 

was  injected  on  the 

28VDC  high  and  return  leads 

of  the  power  supply 

from  30Hz  to  50KHz. 

The  IFO  operation 

was  mon- 

itored  for  susceptibility  by  a visual  check  of  the  test  lamps.  The 
test  setup  is  shown  in  Figure  2. 

TEST  RESULTS 

No  lights  came  on  to  indicate  any  malfunction  during  this  test. 
See  data  sheet  7. 
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APPENDIX  C 
TEST  METHOD  CS02 
CONDUCTED  SUSCEPTIBILITY 
POWER  LEADS 
50 KHz  to  400MHz 
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TEST  EQUIPMENT 


DESCRIPTION 

MODEL/MFG 

SERIAL  NO. 

CAL .DATE 

SIGNAL  GENERATOR 

60618 

Hewl ett-Packard 

434-08498 

8/75 

SIGNAL  GENERATOR 

608  Hewlett- 
Packard 

202-04499 

8/75 

RF  VOLTMETER 

9 1 C A B00NT0N 

1122 

3/76 

CAPACITOR 

EM  I - F-0059 
SANDERS 

N/A 

N/A 

TEST  PROCEDURE 

A 1 volt  RMS 

signal  was  injected  on  the  28VDC  high 

and  return 

leads  of  the  power 

supply.  During  testing 

IFO  operation 

was  moni - 

tored  for  susceptibility  indications  by  a visual  check  of  the  test 
lights.  The  test  setup  is  shown  in  Figure  3. 

TEST  RESULTS 


No  lights  came  on  during  test  to  indicate  malfunction.  See 
data  sheet  8. 
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APPENDIX  D 
TEST  METHOD  CS06 
SPIKE 

POWER  LEADS 
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TEST  EQUIPMENT 

DESCRIPTION 
SPIKE  GENERATOR 
OSCILLOSCOPE 

TEST  PROCEDURE 


MQDEL/MFG 


6471 -F 
SOLAR 

54  1 A 

TEKTRONIX 


SERIAL  NO.  CAL . DATE 
17536  7/75 

022490  10/75 


Positive  and  negative  56  volt  10  ysec  spikes  were  injected  on 
the  plus  28  volt  power  leads. 

( a ) Single  shots 

(b)  6 to  10  PPS 

The  IFO  operation  was  monitored  for  susceptibility  indications  by 
monitoring  indicator  lamps.  The  test  setup  is  shown  in  Figure  4. 

TEST  RESULTS 


No  failure  lamps  came  on.  See  data  sheet  9. 
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APPENDIX  E 
TEST  METHOD  RE02 
RADIATED  EMISSION 
14KHz  to  10GHz 
ELECTRIC  FIELD 
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TEST  EQUIPMENT 


DESCRIPTION 

MODEL/MFG 

SERIAL  NO. 

CAL.  DATE 

EMI  METER 

EMA  910 
EMC 

121-121 

4/76 

EMI  METER 

NF- 105 
EMPIRE 

3348 

7/75 

VERTICAL  ANTENNA 

0DC-100BT 

1 37 

6/75 

B I CON  I CAL  ANTENNA 

7825 

HONEYWELL 

N/A 

N/A 

CONE  ANTENNA 

93490-1 

STODDART 

N/A 

N/A 

CONE  ANTENNA 

93491-1 

STODDART 

N/A 

N/A 

HAND  PROBE 

MP-1 05 

N/A 

N/A 

VERTICAL  ANTENNA 

VR-1 05 
EMPIRE 

181 

5/76 

VERTICAL  ANTENNA 

VA-105 

EMPIRE 

796 

8/75 

EMI  METER 

EMA- 10 
FAIRCHILD 

10342 

12/75 

TEST  PROCEDURE 

Broadband  and  narrowband  radiated  emission  measurements  were 
performed  from  1 4 KHz  to  1 0GHz  . The  measurement  antenna  was  posi- 
tioned 1.0  meter  from  the  test  sample.  The  test  setup  is  shown 
in  Figure  5 . 

TEST  RESULTS 

Broadband  radiated  emissions  exceeding  RE02  limits  were 
detected  at  14KHz,  20KHz  and  31  KHz . Worst  case  emission  at  3lKHz  is 
12dB  above  limit.  Narrowband  radiated  emissions  exceeding  RE02 
limits  were  detected  at  various  frequencies  between  25MHz  and  284MHz 
The  worst  case  narrowband  emission  at  25MHz  exceeds  RE02  limits  by 
2 1 d B . Transient  radiated  emissions  exceeding  RE02  limits  were 

detected  at  25MHz.  The  emission  level  was  1 2dB  above  limits  at  this 
frequency.  See  data  sheets  10  thru  13. 
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TEST  METHOD  RS02 
RADIATED  SUSCEPTIBILITY 
MAGNETIC  INDUCTION  FIELD 
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TEST  EQUIPMENT 


description 

MODEL/M FG 

SERIAL  NO. 

CAL .DA 

SPIKE  GENERATOR 

64  71  -5 
SOLAR 

1 7536 

7/75 

VARIAC 

1 1 6 

SUPERIOR 

N/A 

N/A 

TRANSFORMER 

N/A 

N/A 

N/A 

METER 

2 5 A 

WESTON 

CC673 

2/76 

TEST  PROCEDURE 

A test  wire  carrying  TOO  volt  10 u sec  spikes  was  wrapped  around 
the  case  of  IFO  maintenance  warning  unit  crew  read  out  unit,  all 
cables  and  DC  power  leads. 


A test  wire  carrying  20  amperes  of  400  Hz  current  was  wrapped 
around  same  units.  The  one  operation  was  monitored  for  suscepti- 
bility by  a visual  check  of  the  test  lamps.  The  test  setup  is 
shown  in  Figure  6. 

test  results 

No  failure  lamps  came  on.  See  data  sheet  14. 
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APPENDIX  G 
TEST  METHOD  RS03 
RADIATED  SUSCEPTIBILITY 
ELECTRIC  FIELD 
14Kr!z  to  10GHz 
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TEST  EQUIPMENT 


Description 

Model/Mfa. 

Serial  No. 

Cal  Date 

- . 

EMI  Meter 

EMA-910 

Singer 

121-121 

4/76 

— 

EMI  Meter 

HP- 105 
Empi re 

3348 

7/75 

— 

Osci llator 

HP200  CD 
Hewlett  Packard 

333-546,1  « 

N/A 

- 

Signal  Generator 

HPG06  A 
Hewlett  Packard 

434-084y8 

8/75  = 

- 

Paver  Amplifier 

MO  100 
Bcgen 

J52 

N/A 

Paver  Osci 1 later 

JO.'rA 

Microdot 

32 

12/75 

Power  Oscillator 

406A 

Microdot 

87 

12/75 

Paver  Oscillator 

125 

Airborne  Instru. 

12510 

Lab. 

N/A 

Signal  Generator 

6165 

Hewlett  Packard 

259-00099 

10/75 

Signal  Generator 

C772A 
Mi crolab 

519 

2/76 

Signal  Generator 

X772A 

Microlab 

324 

2/76 

- 

Vertical  Antenna 

V R 1 0 5 
Empire 

181 

5/76 

Vertical  Antenna 

VA- 105 

796 

8/75 

Biconical  Antenna 

7825 

Honeywel 1 

N/A 

N/A 

— . 

Cone  Antenna 

93*90-1 

Stcddart 

N/A 

N/A 

Horn  Antenna 

CA-L,  S,  M,  X 
Pclarad 

N/A 

N/A 

EMI  Meter 

EFS-1  26 

IFI 

317 

9/75 

221 
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Kepurt  U U . 2 4 


TEST  PROCEDURE 

The  one  system  was  immersed  in  an  electric  field  10V/M  from 
14KH z to  35MH2  and  5V/M  from  3 5 ri H 2 to  10GHz.  IFO  operation  was 
monitored  for  susceptibility  by  a visual  check  of  the  test  lamps. 
The  test  setup  is  shown  in  Figure  7. 

TEST  RESULTS 

No  susceptibility  indications  were  observed.  See  data 
sheet  15. 
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FIGURE  3.  CS02  TEST  SETUP 
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FIGURE  5.  RE02  TEST  SETUP 
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APPENDIX  VII 


RELIABILITY  ANALYSIS 


Reference:  MIL-HDBK-217B  20  September  1974 

MIL-STD-756A 

Prediction:  355  Hours,  mean  time  between  failures 

1.  Enclosures 

A.  Mathematical  model  as  described  in  MIL-STD-756A  and  mathematical 
description. 

B.  Failure  rate  schedules  for  each  drawing  number  and  listing 

a.  Item  Number 

b.  Part  type  or  part  drawing  number 

c.  Quantity  of  each  part  required 

d.  Part  rating 

e.  Part  stress 

f.  Part  failure  rate  per  10b  hours 

g.  Total  failure  rate  for  each  item 

h.  Sample  computations 

2.  Design  Prediction  Procedure:  MIL-STD-756A,  Paragraph  5.2 

3.  Computation  Explanation: 

Failures  are  considered  to  be  serial.  If  one  part  should  fail,  the 
whole  equipment  fails. 

MTBF  = — , where  A is  the  failure  rate  of  each  part. 

L A 

CCU  Ambient  temperature  is  taken  to  be  95°C 
CRU  and  MWU  are  taken  to  be  71.1°C. 

Sensors  are  taken  to  be  205°C. 
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SAMPLE  CALCULATIONS 


Reference:  MIL  Handbook  217B 

Formula  (MIL  Handbook  217B,  p 


Reference:  MIL  Handbook  217B 

Formula  (MIL  Handbook  217B,  pg.  2. 2. 5-1): 
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SUB  SYSTEM:  CCU ASS'Y  TITLE  Fire  Warning  Logic 
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SUB  SYSTEM:  CCU ASS'Y  TITLE  Clock  Generator 


10. 7K  Ohms  1 1/8W  .013  .013 

RN60C1072F 


SUB  SYSTEM:  CCU ASS'Y  TITLE  Voltage  Monitor 


C14  270  mF  (Sprague)  1 30V 

1 30D277X003T2 


SYSTEM:  CCU ASS'Y  TITLE  30V  Network 
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SUB  SYSTEM:  CCU ASS'Y  TITLE  CFA  & EFA  LorIc 
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